How to adapt security awareness content to each organization’s culture

In 2012 Metro Trains Melbourne stopped pushing the safety poster and released a song with colorful little characters dying in absurd ways. One of those ways was standing at the edge of a train platform. Dumb Ways to Die started as a rail safety campaign and ended up a global entertainment brand with its own video games; the campaign also reports a 21% drop in incidents.

The underlying message was the same one as always. What got rebuilt was the packaging, and that packaging was calibrated for the people of Melbourne in 2012. The same song, with the same dark humor, could have landed badly somewhere else with a different audience, or offended outright.

Organizations run into this all the time, even if they don’t call it that. Somebody sees the awareness program that worked beautifully at the company next door, replicates it piece by piece, and nothing happens here. The quality of the content didn’t drop along the way. What got left behind was the culture of the organization receiving it, distinct from the culture of the country it sits in and from the culture of the industry it competes in.

What does it mean to adapt awareness to an organization’s culture?

Adapting awareness to an organization’s culture means adjusting the tone, the examples, the channel and the format of the content to the way that organization works and talks, while keeping fixed the behavior the program wants to change. It is a content decision, made before picking the first piece.

It is worth separating it from two things it often gets confused with.

One is branding. Having the program carry your own logo and live on your organization’s own domain changes a great deal about how it is received, because it stops looking like a vendor’s advertising. But that is the top layer. Content can have a perfect logo and still describe a world the people at that company don’t recognize.

The other is language. Having the material in several languages for a multinational is essential and not enough. Two subsidiaries that share a language can have opposite working cultures, and conversely, two plants of the same company in different countries can look remarkably alike. Language is chosen by country. Culture is read by organization.

The idea isn’t an eccentricity of ours either. NIST SP 800-50r1, from September 2024, presents its recommendations for building a cybersecurity learning program as something customizable and applicable to each organization’s own process, with the explicit goal of developing a security culture inside it. It says so in general terms, without saying how. The how is the part that falls to us.

How do you read an organization’s culture before choosing content?

No engagement survey required. There are five signals already in plain sight, observable in a week of conversations with whoever coordinates each area.

The first is which channel people actually hear things through. What counts is the one in real use, more than the one on the org chart. In some organizations it’s email, in others a messaging group nobody administers, in others the Monday meeting, and in others whoever hands out the day’s assignments.

The second is how things are named internally. Every organization has its own vocabulary, and that vocabulary works like a password. If everyone at your company says “the file” and the content says “the employee record”, you have already lost half a second of attention to the translation. Half a second sounds like nothing, and in a one-minute piece it is an eternity.

The third is what happens when somebody makes a mistake. It’s the most uncomfortable signal and the one that shapes the outcome most. Where mistakes get reported without drama, a phishing simulation is received as an exercise and the educational moment that follows gets read all the way through. Where mistakes get buried, the same simulation is received as a company trap, and the first thing people learn is to warn each other that a campaign is running (which, incidentally, demonstrates admirable internal communication).

The fourth is who holds informal authority. The person the rest believe doesn’t always sign the announcement, and when content arrives through them, it arrives differently.

The fifth is how much real time there is, and when. It is a constraint of the role before it is a preference, and we looked at it closely when writing about audiences who don’t work in front of a screen.

With the five signals on the table, choosing content stops being a matter of taste.

Cultural signal observed	Content decision it suggests
People hear things through a person before a channel	A short script to be told out loud, instead of a piece to forward
Strong, distinctive internal vocabulary	Edit the examples and the system names before the first campaign
Mistakes get buried	Start with narrative content and leave the simulation for later
Mistakes get reported without punishment	Early simulation, with the educational moment as the centerpiece
Informal authority spread across areas	Short pieces each area lead can present as their own
Working day split into gaps of minutes	Steady drip in small doses, never the half-hour session
Very formal culture, regulated industry	Sober tone and examples from the industry itself, no filler humor
Informal culture, young teams	Comic, video game and competition between areas

Crossing that with which format serves which behavior closes the choice.

Which part of the program doesn’t get adapted?

The target behavior, the criterion used to validate it and the evidence you need to be able to show. Reporting a suspicious email instead of deleting it, verifying through a second channel a payment request that arrived in a hurry, never reusing your work password anywhere else. That is the same at a bank and at a logistics company, and it isn’t negotiated with anybody’s culture.

The packaging gets adapted. The reflex we want to train stays the same.

The risk of overdoing it is worth naming, because it shows up fast. An organization that avoids conflict can push toward content so soft it never names the risk, and there the adaptation has eaten the message. The test is simple. If by the end of the piece the person doesn’t know what they are expected to do differently tomorrow, the adjustment went wrong, however comfortable the piece feels.

How can you tell the adaptation worked?

You can tell from three movements, and none of them is the quiz score.

Participation stops depending on the reminder. When content lands inside the culture, people complete it without management having to ask a third time.

Voluntary reporting of suspicious emails goes up. It’s the behavior most sensitive to the internal climate of everything we measure, because reporting exposes whoever reports.

And the validation question stops failing at the same point every time. When the same misunderstanding repeats in one area and not in the others, the problem lies in how you translated the example for that area more than in what people know.

It is worth looking at several consecutive months before concluding anything. A single month can be an internal campaign that pushed the numbers, or a quiet week.

What does the platform solve and what stays on your side?

SMARTFENSE content is developed with a focus on the target audience of Latin America, Spain, Portugal and Italy, through a regionalization process rather than a direct translation, and with the explanation of the why in the foreground ahead of the list of what to do. That regional culture layer comes solved out of the box.

On top of it there are two concrete levers. Variables let you define once a piece of the organization’s own data, such as the number incidents get reported to, and have every content item that uses that data show it already adjusted. And any content can be edited 100%, so the internal vocabulary gets in without asking anyone’s permission. Catalogs separated by program audience do the rest, because within the same organization the plant, the office and the sales team are three cultures living under the same logo.

What no platform knows is whether a joke works inside your organization. The people who work there know, and that is the part of the job that doesn’t get automated.

What travelled out of Melbourne

The dark humor wasn’t what got exported from that song. What got exported was the idea of looking at the real audience before deciding the format, which is a considerably less catchy idea and a considerably more useful one.

Before the next campaign, try a single question in the area meeting. If somebody at this organization gets caught out by a strange email, what do they do? The answer will tell you where to start, and it tends to differ from what the program had been assuming.