In many organizations, significant effort is put into privacy and security awareness. Trainings are launched, campaigns are rolled out, videos are shared, and sometimes complete e-learning programs are deployed. Yet despite all these efforts, participation remains low and behavior hardly changes. The cause? Not the content, not the tools, not the employees—but managers who say nothing.
“Awareness does not fail because of a lack of knowledge, but because of a lack of leadership.”
When managers remain silent, a vacuum emerges in which employees try to determine for themselves how important something really is. And they don’t base that judgment on policy, but on social signals. If their manager never mentions awareness, if it is not discussed in meetings, if no time is allocated to it, one conclusion naturally follows: it must not be that important.
You see this everywhere: people postpone e-learning “until later,” ignore campaign messages, or click away as soon as they see the word security. Not because they don’t want to contribute, but because no one in their direct environment shows that it truly matters. Awareness evaporates when leaders stay silent.
Leadership sets the tone—literally and figuratively
Awareness is not a communication project; it is a leadership responsibility. Behavior only changes when people feel that the topic is supported at every level of the organization. And those signals do not come from videos or training modules, but from people they trust: their managers, team leaders, and executives.
When a director explains why digital security matters in a speech, when a team leader states that security is part of professional behavior, when a manager dares to share a personal incident, something fundamental happens. The topic shifts from “an IT thing” to “our work.”
That shift is exactly what employees need. Without clear norms, awareness remains optional. But when managers articulate expectations, awareness becomes part of the collective culture. Safe behavior starts with words and is reinforced by actions. A manager who completes a training themselves has more impact than ten intranet messages. A board member who shares a personal example achieves more than an entire toolkit.
Management involvement turns awareness from obligation into conviction
Awareness can only succeed when employees feel included rather than instructed. When their leaders do not observe from the sidelines, but actively participate. When time, space, and attention are deliberately organized instead of squeezed in.
Genuine management involvement completely changes the dynamic. Employees notice that the topic is valued, that they are taken seriously, and that there is room to learn. Questions are asked more often, incidents are reported sooner, and trainings no longer feel like a mandatory chore, but like a natural part of the job.
With management involvement, awareness becomes more than a campaign—it becomes culture. A shared responsibility. A collective mindset. Awareness only works when managers open the conversation and give employees the space to move with it.