A strong cybersecurity culture may be the most underrated defense your business has — and because so much risk rides on the devices and services your teams use every day, it goes hand in hand with disciplined telecom expense management and IT oversight. According to IBM’s 2025 Cost of a Data Breach Report, the average breach now costs a U.S. company $10.22 million — an all-time high for the 15th year running. It is vital to protect any business from cyber attacks, but there is a component to this problem that most companies overlook: their people.
The uncomfortable truth is that the majority of breaches trace back to the human element. Verizon’s 2025 Data Breach Investigations Report attributes roughly 60% of breaches to people — not secret spies or traitors, but simple oversight and risky, passive behavior that malicious actors exploit. No amount of security software can overcome an employee who takes work home and doesn’t secure it. So how do you overcome the issue?
Ad Hoc Security Isn’t Enough
There are two typical responses to learning about internal threats to cybersecurity. The first is to invest heavily in security controls that prevent employee mistakes. Systems are locked down tight, and active controls try to minimize risk everywhere. While this can have a positive impact, it doesn’t always work well. Often, such measures kill efficiency for every kind of work. Employees get frustrated with the lack of control and trust, and many will find ways to circumvent the security measures just to get their jobs done. It is not impossible for this kind of heavy-handed security to actually make risks worse.
The other major response is to invest in massive security retraining. Every employee is put through a program explaining risky behaviors and why they matter. This too can get decent results, but if you have enough employees or give them enough time, risk will re-emerge. People make mistakes, and retraining tends to have a shelf life. Eventually, some people revert to bad habits and risk is revisited.
Shifting to a Cybersecurity Culture
What retraining starts, a cybersecurity culture sustains. If workplace culture can drive retention and motivation, why not apply it to security? When best practices are built into the culture, you get a positive feedback loop that fosters good behavior and keeps risk to a minimum. Nothing fully eliminates security risks, but a culture shift is an excellent way to cut into that $10.22 million average that no one wants to pay. IBM’s own research backs this up: organizations that embed security into how they work — through approaches like DevSecOps and ongoing employee training — measurably lower their breach costs.
One aspect of a security-based culture change is fostering relationships between IT and the rest of the staff. Even if all of your IT and security is outsourced, there are ways to increase face time and communication between groups. That may require a financial investment, but when there’s a personal connection between the security team and everyone else, it’s easier to trust their advice and pitch in on the cause.
Related from Valicom: nurture the smart device culture culture that keeps everyday devices secure.
On the flip side, a top-down culture shift can also drive big improvements in data security. When security is a core component of growth and development, you naturally steer around the risks that plague too many businesses. This is the idea behind DevSecOps: development, security, and operations working cohesively, with every project represented by all three groups. If you’re overhauling a smartphone app for your business, for example, don’t just hand it to an app developer — intentionally put a member of the security team and the operations team on the project too. It keeps a balanced outlook from the start and tends to lead to more secure, more functional software.
Related from Valicom: see how monetising mobile data key offsetting fits a smarter device strategy.
Building a Lasting Cybersecurity Culture
Culture change is never easy. It takes sincere, long-term commitment from the top to the bottom of the entire organization. But when it works, it leads to lasting changes that improve the workplace for everyone. At a minimum, a security-focused culture change is well worth considering to keep your business from losing millions to data breaches — because in the end, a cybersecurity culture is what turns good intentions into secure habits.
