Towards a robust cybersecurity awareness programme #5: Factors affecting behaviour

© Image by on Freepik

There are three things that will require your focus when establishing security and privacy arrangements within your institution: technology, awareness and organisation. In this blog series, we will take a closer look at awareness: what does awareness involve, what do we need to know about human behaviour, and how should you establish a robust awareness programme? This fifth blog in the series of 8 is about the factors that influence the behaviour of your target groups.

People are influenced by numerous factors, as a result of which they will ultimately either exhibit the desired behaviour, or they won’t. In this phase, we will set out the key behavioural factors for each target behaviour. This will help you determine which buttons you will need to press to achieve the desired behavioural outcomes.

Mapping out the behavioural factors

Behaviour is always the result of various internal and external factors. These factors help you gain a good picture of how your target behaviour can be reached. These factors include: social environment, emotions and associations, physical environment, self-image, skills, habits and automatic responses, attitude, intention, and knowledge.

There will always be some factors that affect the desired behaviour more than others. You should think about which factors you think will prevent people from exhibiting the desired behaviour, which factors would encourage this, and to what extent they play a role (consciously or sub-consciously).

Select the most important behavioural factors

Once you have determined which factors will influence each behavioural goal, you should then decide on a top 3. These are the factors that you will ultimately have to influence to achieve the desired behavioural outcomes. These tips will help you decide which are the most important factors:

  • Emotions, associations and the social environment will generally have a strong influence. Give these priority.
  • Are any specific factors needed? In other words, are there any factors that are essential for behavioural change? Make sure these are in the top 3. For example, a knowledge factor is generally essential (how to recognise a phishing email).
  • Which factors will offer the greatest chance of success in changing behaviour?

Next step

For each behavioural goal, you now know the most important factors that will influence the desired behaviour. From this, you are now able to determine the associated actions and interventions. In the next blog, we will look at what resources you can use to influence these factors.

Other blogs in this series:

About the authors

This series of blog posts has been created by the GÉANT Cyber Security Month team, in close collaboration with SURF.


Also this year GÉANT joins the European Cyber Security Month, with the campaign 'A Community of Cyber Heroes'. Read articles from cyber security experts within our community and download resources from our awareness package on
Skip to content