A global study found that 94% of organizations across Europe, the Middle East, and Africa confirm that cybersecurity awareness training directly reduces cyber incidents, underscoring the critical role of employee education in protecting digital systems. The survey, conducted by Fortinet, included 500 senior IT and cybersecurity decision-makers across the region and revealed how organizations are prioritizing workforce readiness against evolving threats.
The findings align with the objectives of Saudi Vision 2030, which emphasizes enhancing digital innovation, protecting data, and building advanced national cybersecurity capabilities to ensure a secure and resilient digital environment for the Kingdom’s digital transformation.
AI-Driven Threats Reshape Security Strategies
Around 81% of respondents confirmed that artificial intelligence-driven attacks have increased the perceived importance of cybersecurity awareness training among employees. Additionally, 93% of organizations have either implemented or are researching policies governing the use of generative AI tools, while 96% have implemented or are investigating measures to test and validate the security of these technologies, including large language models.
Training Programs Deliver Measurable Results
Organizations implementing structured cybersecurity awareness training programs are achieving tangible results. About 65% of respondents reported a moderate to significant reduction in cyber incidents, while 94% confirmed an improvement in their overall security posture. Phishing simulation exercises emerged as one of the most effective training tools, adopted by 69% of organizations to enhance employees’ ability to detect and respond to threats.
These programs help embed a security-first culture within organizations, improving employee readiness and reducing cyber risks. In terms of training priorities, data security (49%) and data privacy (42%) ranked highest, followed by AI-related threats (38%). Around 50% of organizations are actively training employees on the safe and responsible use of generative AI technologies, while 51% have implemented technical controls to prevent sensitive data leakage.
Leadership Support and Program Customization
Executive leadership plays a crucial role in supporting cybersecurity training initiatives. About 93% of respondents confirmed direct support from leadership, while IT and cybersecurity departments manage the operational aspects of these programs. In terms of content quality, 76% of organizations have adopted structured training programs, and 84% offer customized programs tailored to specific employee groups.
“With cyber threats becoming increasingly complex in the age of AI, Saudi Arabia is well-positioned to lead the region in building a secure and safer digital future due to its strong regulatory footing, a focus on local skills development and extensive investment in digital infrastructure. The findings reinforce that alongside technology investments, empowering employees through continuous cybersecurity education will be key to safeguarding the Kingdom’s digital transformation journey.”
Sami AlShwairakh, Regional VP for Saudi Arabia, Fortinet
Resource Gaps and Future Priorities
Despite this progress, challenges remain. Around 67% of respondents believe employees still lack sufficient cybersecurity knowledge, while 32% pointed to a gap between theoretical knowledge and actual behavior in the workplace. The shortage of skilled talent poses another obstacle, with 28% of organizations attributing delays in implementing awareness programs to a lack of qualified personnel.
As a result, there is a growing need for continuous and updated cybersecurity awareness programs, especially as AI-driven threats evolve and insider risks increase. Organizations must also address factors that may reduce program effectiveness, such as low training completion rates and outdated content.
The study concluded that the next phase requires integrating cybersecurity training into enterprise risk management frameworks, positioning it as a core component of sustainable digital security rather than a secondary initiative. The effectiveness of awareness programs depends on continuity, regular content updates, and impact measurement, reinforcing cybersecurity as a key enabler of growth in the digital economy.
