The benefits of developing cybersecurity programs in businesses are justified in the costs. One type of investment in a cybersecurity program a business can do is implementing a program to train employees. They can employ in-house staff to develop these training programs, or hire a cybersecurity consultant contract to train staff on best practices. This can highlight any weaknesses that the employees may have when carrying out their tasks. It also provides guidance on some of the backbone practices of secure behavior. One of the studies indicated that there are differences in regions in how people decide what kind of identity management they adopt. Training employees good practices for using unique passwords, two factor authorization, and not writing down the passwords in a public area promote security.

In studies that evaluate surveys on training, there are guidelines on how to implement this training. In order for the costs of the training to be effective, there are guidelines such as making the training frequent, making it relevant to the employee (such as relevant to the employee’s job role), connecting the relevancy of how the human error can effect the security of the system, and mandating the training from the leadership level. This is also interlaced with a company culture of developing a cybersecurity environment. that maintains security complaince.

In the broad sense, the cost of cybersecurity programs are justified in business expenses. In one of the instructional videos, a Chief Security Officer has to relay to other members of leadership the importance of a cybersecurity program, and why it would be justified. Stating that the passive reassurance of the analogy of a parking lot full of cars prevents low level theft just isn’t enough. For a business, attackers are on a higher level of getting unauthorized access, in the analogy he uses an example of someone waiting for the car owner to open up the door, and then gain access. There is a stressing of the importance of a robust security program to prevent catastrophic business losses and downtime.