What cybersecurity awareness techniques have you found most effective?

1) Do year-round training - not one and done annually. 
2) Keep content brief, frequent and focused.
3) Teach people things they do not already know. (Note: some repetition is fine, but don't make it constantly like TV reruns that they've seen 5-7+ times. 
4) Make it interactive and fun. (Videos alone are not interactive.) 
5) Gamify the content if possible. 
6) Mix in multiple modes of delivery. (including in-person events, newsletters, brief modules, emails, quick tips, +++) 
7) Change it up.  Don't have the same program every year - boring. 
8) Get feedback. Talk to staff and management about what's missing.
9) Talk to industry vertical peers about their experiences and programs. 
10) Know your audience and tailor to their needs (adding current incident events that are relevant and impactful.)   

Implement a comprehensive security policy. Establish a comprehensive security policy that outlines the company’s expectations for security practices, including user access and authorization, password strength, data encryption and storage, and other best practices.

We have done a series of things.  What was most effective was using KnowBe4 for training and assessments.  This helped to put my users on alert about cybersecurity.  It also helps to do phishing tests a few times a year to make sure everyone is staying alert.  We look at the types of spam emails that come through and set up our phishing tests based on those emails.   

We’ve seen both the participation and the learning improve when we’ve run gamified sessions and exercises related to security for both general compliance hygiene and dev security. Another thing is to make sure the learning is followed by a re-learning after regular intervals.

1. Conduct cyber security awareness weeks and mandatory training for the staff. Distribute easy to use checklists(printed/digital) that eliminate the need to remember what to do in case of an emergency or avoid the attack itself.
2. Simulate social engineering/phishing tests for the staff and recommend training for those who failed.