A Single Employee Click Cost MGM Resorts $100 Million

In September 2023, MGM Resorts International disclosed a devastating cyberattack that disrupted hotel operations, slot machines, and reservation systems across Las Vegas. The attack vector? A social engineering phone call. A threat actor impersonated an employee, called the IT help desk, and gained enough access to deploy ransomware across the enterprise. The estimated cost: over $100 million in lost revenue and remediation.

That's not a technology failure. That's a culture failure. And it proves that building a real cybersecurity culture in the workplace isn't optional — it's the single most important investment your organization can make right now.

This guide is for security leaders, IT managers, and business owners who are tired of checkbox compliance training and want to actually change how their people think about security. I'll walk you through what a strong security culture looks like, why most organizations get it wrong, and the specific steps that move the needle based on real-world experience.

What Cybersecurity Culture in the Workplace Actually Means

Let me be direct: cybersecurity culture is not a poster on the breakroom wall. It's not an annual training video your employees click through while checking email. Those are artifacts of a program. Culture is different.

A genuine cybersecurity culture in the workplace means that security-conscious behavior is the default — not the exception. It means an accounts payable clerk questions a wire transfer request even when it appears to come from the CEO. It means a developer flags a suspicious API call instead of assuming someone else will catch it. It means new hires absorb secure habits from their peers before IT ever sends a training reminder.

The Verizon 2023 Data Breach Investigations Report found that 74% of all breaches involved the human element — including social engineering, errors, and misuse. You can deploy the most sophisticated endpoint detection on the planet, and a single employee who reuses passwords or falls for credential theft phishing will render it irrelevant.

The $4.88M Lesson Most Organizations Learn Too Late

IBM's 2023 Cost of a Data Breach Report pegged the global average cost of a data breach at $4.45 million. In the United States, that number climbed to $9.48 million. These aren't just numbers — they represent legal fees, regulatory fines, customer notification costs, lost business, and the quiet erosion of trust that takes years to rebuild.

Here's what I've seen repeatedly in incident response: organizations that suffer the worst outcomes almost always share the same characteristics. Security is siloed inside the IT department. Employees view security policies as obstacles. Leadership treats cybersecurity as a cost center rather than a business enabler.

Contrast that with organizations where I've seen breaches contained quickly and cheaply. In every case, employees were empowered to report suspicious activity without fear of punishment. Phishing simulation programs were running monthly. Leadership visibly participated in security initiatives. The difference wasn't budget — it was culture.

Five Pillars of a Workplace Security Culture That Works

1. Leadership Sets the Tone — Or Destroys It

If your CEO bypasses multi-factor authentication because it's inconvenient, your culture is already broken. I've consulted with organizations where the C-suite demanded MFA exceptions for themselves while mandating it for everyone else. Employees notice. They always notice.

Leadership must visibly follow the same security policies as everyone else. That means completing the same security awareness training, participating in phishing simulations, and talking about cybersecurity in all-hands meetings — not just after a breach makes the news.

Practical step: Have your CEO or president send a personal message (not from IT) at the start of every security awareness campaign. Make it clear that security is a business priority, not just a technical one.

2. Continuous Training Replaces Annual Checkboxes

Annual training doesn't work. I've watched employees pass a 45-minute compliance module in January and fall for a basic phishing email in March. The forgetting curve is real — research consistently shows that security knowledge decays within weeks without reinforcement.

What works is ongoing, bite-sized training delivered throughout the year. Short modules on specific threats — business email compromise one month, ransomware the next, credential theft the month after. Pair those with regular phishing simulations that test real-world scenarios your employees actually face.

If you're looking for a structured approach to security awareness training, the cybersecurity awareness training program at computersecurity.us covers the essential topics your workforce needs. For targeted anti-phishing exercises, the phishing awareness training for organizations provides simulation-based learning that builds real muscle memory.

3. Make Reporting Easy and Consequence-Appropriate

Here's what actually happens in most organizations: an employee clicks a suspicious link, realizes the mistake, and says nothing. Why? Because they're afraid they'll be punished. So the threat actor has hours — sometimes days — of undetected dwell time inside your network.

A strong cybersecurity culture in the workplace treats reporting as a positive behavior, not a confession. Implement a one-click phishing report button in your email client. Celebrate employees who report suspicious messages. Track report rates as a KPI alongside click rates.

The organizations with the fastest incident response times are the ones where employees feel safe saying, "I think I just made a mistake." That psychological safety is a culture outcome, not a technology feature.

4. Integrate Security Into Business Processes

Security can't live exclusively in the IT department. It has to be embedded into how your business actually operates. That means:

  • Finance teams have a verbal verification process for any wire transfer request over a defined threshold.
  • HR includes security responsibilities in every job description, not just IT roles.
  • Procurement evaluates vendor security posture before signing contracts.
  • Onboarding includes a dedicated security orientation — not just a policy acknowledgment form.

When security is part of every department's workflow, it stops being "IT's problem" and becomes everyone's responsibility. That's the zero trust mindset applied to organizational behavior — never assume someone else is handling it.

5. Measure What Matters

You can't improve what you don't measure. Most organizations track phishing simulation click rates and call it done. That's one metric. Here are better ones:

  • Phishing report rate: What percentage of simulated phishing emails do employees actively report? This matters more than click rate.
  • Mean time to report: How quickly do employees flag suspicious messages after receiving them?
  • Training completion velocity: How fast do employees complete assigned modules? Delays signal disengagement.
  • Repeat clicker rate: What percentage of employees fail multiple phishing simulations? These individuals need targeted intervention.
  • Security question volume: Are employees proactively asking security questions? An increase is a positive culture signal.

How Long Does It Take to Build Cybersecurity Culture?

This is the question I get most often, so let me answer it directly. Building a meaningful cybersecurity culture in the workplace takes 12 to 18 months of consistent effort. You won't see dramatic changes in the first quarter. By the second quarter, phishing simulation metrics typically start improving. By the third and fourth quarters — if you've maintained consistency — you'll see employees proactively reporting threats they would have ignored six months ago.

The key word is consistent. Organizations that run a burst of training after a scare and then go quiet for six months end up right back where they started. Culture is built through repetition and reinforcement, not events.

Social Engineering: The Threat That Exploits Culture Gaps

Social engineering remains the most effective attack vector because it targets human psychology, not software vulnerabilities. The MGM Resorts attack I mentioned at the top used vishing — voice phishing — to bypass technical controls entirely. The Caesars Entertainment breach, disclosed around the same time in September 2023, involved a similar social engineering approach targeting an outsourced IT support vendor.

CISA's guidance on cybersecurity best practices emphasizes that technical defenses must be paired with human-layer defenses. No firewall stops an employee from reading a convincing spoofed email and entering their credentials on a fake login page.

In my experience, organizations that run monthly phishing simulations combined with immediate just-in-time training for employees who click see a 60-75% reduction in successful phishing within six months. That's not a technology improvement — that's culture shifting.

The Role of Zero Trust in Culture Building

Zero trust is often discussed as a network architecture philosophy — never trust, always verify. But it's equally powerful as a cultural principle. When your employees internalize the idea that they should verify every unusual request regardless of who it appears to come from, you've achieved something no firewall can replicate.

Practical applications of zero trust culture:

  • An employee receives an email from the CFO requesting an urgent wire transfer. Instead of complying immediately, they call the CFO directly on a known phone number to verify.
  • A help desk technician receives a password reset request from someone claiming to be a senior executive. They follow the identity verification protocol instead of making an exception for rank.
  • A developer receives a Slack message from a "colleague" asking for access credentials to a staging environment. They verify through an independent channel before sharing anything.

This is what cybersecurity culture looks like in practice. Not paranoia — professional verification habits baked into daily workflow.

What the FBI's IC3 Data Tells Us About Human-Targeted Attacks

The FBI's Internet Crime Complaint Center (IC3) 2022 annual report documented over 800,000 complaints with losses exceeding $10.3 billion. Business email compromise (BEC) alone accounted for $2.7 billion in adjusted losses — making it the single most financially damaging cybercrime category.

BEC doesn't rely on malware or zero-day exploits. It relies on a threat actor convincing a human to do something — transfer money, share credentials, redirect payroll. Every dollar of that $2.7 billion was lost because a human made a decision without adequate verification. That's the cost of weak culture, measured in billions.

Your 90-Day Quick-Start Plan

If you're starting from zero — or effectively zero — here's a practical 90-day framework to begin building cybersecurity culture in the workplace:

Days 1-30: Assess and Baseline

  • Run a baseline phishing simulation to measure current vulnerability. Don't announce it.
  • Survey employees on their security knowledge and attitudes. Anonymous responses yield honest data.
  • Identify your repeat clickers and highest-risk departments.
  • Get written executive sponsorship for a 12-month security culture initiative.

Days 31-60: Launch and Train

Days 61-90: Reinforce and Measure

  • Run a second phishing simulation and compare results to your baseline.
  • Publicly recognize employees and departments with the highest report rates.
  • Address repeat clickers with targeted, one-on-one coaching — not punishment.
  • Share metrics with leadership and the broader organization. Transparency builds accountability.

The Long Game Is the Only Game

I've been in this industry long enough to watch organizations cycle through panic-driven security spending. A breach happens, budgets spike, training gets mandated, and then attention drifts. Twelve months later, the same vulnerabilities exist because the culture never actually changed.

Building cybersecurity culture in the workplace is not a project with a completion date. It's an ongoing operational discipline — like financial controls or quality assurance. The organizations that treat it this way are the ones that avoid becoming the next headline.

The NIST Cybersecurity Framework's core functions — Identify, Protect, Detect, Respond, Recover — all require human participation to work. Technology enables each function. People execute it. And culture determines whether they execute it well or not at all.

Start today. Run that baseline phishing test. Get your executive sponsor. Deploy training that respects your employees' intelligence and time. Measure relentlessly. And understand that the goal isn't perfection — it's a workforce that thinks about security as naturally as they think about doing their actual job.

That's culture. And it's the only defense that scales.