From 24% to 3%: Building an Award-Winning Security Culture

Finning, BC's second-largest company and the world's largest Caterpillar dealer, wanted to elevate cybersecurity to the same cultural standing as its highly respected workplace safety culture. Spread across Canada, the UK, and South America, the organization needed to change security behaviour at scale, not just meet compliance requirements. A previous consultancy had failed to deliver the results Finning was looking for.

Change Champions partnered with Finning's global IT Security, Learning, and Communications teams to drive genuine cultural change, grounded in PROSCI-certified change management. Key actions included:

• Defining a clear vision for cybersecurity behaviour change across the enterprise
• Building a yearly awareness roadmap and engaging regional stakeholders as sponsors
• Creating a program brand and tagline: "Our Finning. Our Security."
• Developing engaging materials including posters, videos, and infographics
• Establishing a global network of 60+ security ambassadors
• Assigning role-based training and running realistic phishing simulations
• Measuring progress with both objective metrics and employee perception data

The program delivered measurable, lasting impact. Phishing click rates fell dramatically, engagement stayed high across every geography, and the global security awareness site became one of the most visited pages on the company intranet. Most importantly, cybersecurity was elevated to the same level as physical safety, a core Finning value. The program earned a CSO50 Award for innovation and was presented at BC Aware 2018.

Compliance training checks a box. It rarely changes behaviour. This engagement shows the alternative: treat security awareness as a people and culture challenge, back it with measurement, and risky clicks fall while a genuine security culture takes hold, one strong enough to win national recognition.