标题： 当技术不足以应对时：来自安全关键工业组织试点网络安全文化评估的见解 显示英文标题

标题： When technology is not enough: Insights from a pilot cybersecurity culture assessment in a safety-critical industrial organisation

摘要： 随着网络威胁越来越多地利用人类行为，仅靠技术控制无法确保组织的网络安全（CS）。在关键安全行业，加强网络安全文化（CSC）至关重要，但现实工业环境中的实证研究却很少。本文通过在一个全球关键安全组织中进行试点混合方法的CSC评估来填补这一空白。我们考察了员工的CS知识、态度、行为以及塑造这些因素的组织因素。在两个国家的全球组织中进行了问卷调查和半结构化访谈，这两个国家因钓鱼模拟测试表现不同而被选中：国家1表现较强，国家2表现较弱。在国家1，邀请了258名员工（参与率为67%），在国家2，邀请了113名员工（参与率为30%）。分别有20人和10人参加了访谈。总体的CSC概况相似，但揭示了不同的挑战。两者都表现出较强的钓鱼意识并重视CS，但大多数人将钓鱼视为主要风险，并且对处理其他事件缺乏清晰的认识。一线经理是默认联系人，但对报告的问题跟进不明确。参与者强调将CS期望与工作相关性和工作流程相一致。出现的关键差异因素是：国家1有外部员工，他们对CS培训和政策的访问有限，突显了监控的不足。在国家2，低问卷回应率是由于“邮件中无链接”的政策。虽然该政策可能提高了钓鱼测试的表现，但也凸显了CS实践中的不一致性。研究结果表明，强大的CSC需要领导层的参与、有针对性的沟通、量身定制的措施、政策与实践的一致性以及定期评估。将这些措施融入战略中可以补充技术防御，加强关键安全环境中的可持续CS。 显示英文摘要

摘要： As cyber threats increasingly exploit human behaviour, technical controls alone cannot ensure organisational cybersecurity (CS). Strengthening cybersecurity culture (CSC) is vital in safety-critical industries, yet empirical research in real-world industrial setttings is scarce. This paper addresses this gap through a pilot mixed-methods CSC assessment in a global safety-critical organisation. We examined employees' CS knowledge, attitudes, behaviours, and organisational factors shaping them. A survey and semi-structured interviews were conducted at a global organisation in safety-critical industries, across two countries chosen for contrasting phishing simulation performance: Country 1 stronger, Country 2 weaker. In Country 1, 258 employees were invited (67%), in Country 2, 113 were invited (30%). Interviews included 20 and 10 participants respectively. Overall CSC profiles were similar but revealed distinct challenges. Both showed strong phishing awareness and prioritised CS, yet most viewed phishing as the main risk and lacked clarity on handling other incidents. Line managers were default contacts, but follow-up on reported concerns was unclear. Participants emphasized aligning CS expectations with job relevance and workflows. Key contributors to differences emerged: Country 1 had external employees with limited access to CS training and policies, highlighting monitoring gaps. In Country 2, low survey response stemmed from a "no-link in email" policy. While this policy may have boosted phishing performance, it also underscored inconsistencies in CS practices. Findings show that resilient CSC requires leadership involvement, targeted communication, tailored measures, policy-practice alignment, and regular assessments. Embedding these into strategy complements technical defences and strengthens sustainable CS in safety-critical settings.