---
title: The Growing Gap Between Cybersecurity Awareness and Action
description: Cybersecurity awareness is rising, but secure behaviors are declining. Learn how housing organizations can address cybersecurity fatigue.
image: https://blog.haigroup.com/hubfs/Cyber%20Featured%20Image.png
---
[Skip to content](https://blog.haigroup.com/the-growing-gap-between-cybersecurity-awareness-and-action#main-content)
[](https://www.haigroup.com/)
- SEARCH
- [Cybersecurity](https://blog.haigroup.com/tag/cybersecurity)
# The Growing Gap Between Cybersecurity Awareness and Action
- June 23, 2026
[Ally Modugno | Marketing Specialist | HAI Group](https://blog.haigroup.com/author/ally-modugno)
[\< Back to Resource Center](https://blog.haigroup.com)
For years, organizations have invested heavily in cybersecurity awareness. Employees today are more familiar with phishing scams, multifactor authentication, password security, and online threats than ever before. Yet new research suggests awareness alone may not be enough.
The National Cybersecurity Alliance's [Oh, Behave! Cybersecurity Attitudes and Behaviors Report 2021-2025](https://www.staysafeonline.org/articles/oh-behave-cybersecurity-attitudes-and-behaviors-report-2021%E2%80%932025) found that while cybersecurity awareness has increased significantly over the past five years, many of the behaviors that help prevent cyber incidents have declined. For housing organizations, this trend presents a growing challenge. As cyber threats become more sophisticated and digital systems play a larger role in daily operations, organizations must find ways to turn awareness into action.
## Awareness is rising while secure behaviors are declining
The report highlights a surprising contradiction. Awareness of multifactor authentication (MFA) increased from 52% in 2021 to 77% in 2025. At the same time, the number of people who consistently use MFA declined.
Other security habits have followed a similar pattern. The percentage of people who always install software updates immediately fell from 44% to 31%, while the percentage who always look for signs of phishing dropped from 51% to 36%. Meanwhile, cybercrime victimization increased from 34% to 44% over the same period. These findings suggest that the challenge organizations face today is not a lack of cybersecurity knowledge.
"The issue is no longer awareness," said Troy LePage, executive vice president and chief operating officer at HAI Group. "Most employees understand that cybersecurity matters. The challenge is maintaining secure habits in an environment where people are managing more technology, more information, and more competing priorities than ever before."
As technology continues to evolve, organizations are being asked to navigate a rapidly changing threat landscape that includes artificial intelligence, increasingly sophisticated phishing attempts, and a growing reliance on digital tools.
"Technology is advancing at an incredible pace," LePage said. "Organizations need to focus not only on educating employees about cybersecurity risks but also on creating systems and processes that make secure behavior easier and more consistent."
## Understanding cybersecurity fatigue
One reason secure behaviors may be declining is cybersecurity fatigue. The report found that 43% of respondents feel overwhelmed by the amount of cybersecurity information they receive, up from 34% in 2021. At the same time, concern about cybercrime continues to grow, with 68% of respondents expressing worry about becoming a victim.
For many employees, repeated warnings, constant alerts, and an endless stream of new threats can eventually become background noise.
"Human nature is to become desensitized to repeated warnings," said Mike Konopka, manager of information security at HAI Group. "When people hear the same messages over and over, they can start to tune them out, even when the risks are real."
This doesn't mean employees don't care about cybersecurity. Instead, it highlights the need for organizations to rethink how they communicate risk and reinforce good habits.
"People are balancing dozens of responsibilities every day," Konopka said. "If security feels complicated, disruptive, or disconnected from their daily work, it becomes harder to maintain those behaviors consistently."
## Why this matters for housing organizations
Cybersecurity incidents can affect every aspect of a housing organization's operations. Housing organizations manage sensitive resident information, financial transactions, vendor relationships, and critical business systems. A successful cyberattack can disrupt operations, expose confidential data, and create significant financial and reputational consequences.
[Business email compromise (BEC)](https://www.youtube.com/watch?v=bYsvhk3IrvA), [phishing attacks](https://blog.haigroup.com/ai-driven-phishing-schemes-what-public-and-affordable-housing-agencies-need-to-know), [ransomware](https://blog.haigroup.com/the-resurgence-of-ransomware-and-what-it-means-for-housing-organizations), and [social engineering](https://blog.haigroup.com/dont-get-hooked-what-housing-organizations-need-to-know-about-social-engineering-attacks) schemes continue to target organizations of all sizes. Cybercriminals often focus on human behavior because it remains one of the easiest paths into an organization.
"Cybersecurity is no longer just an IT issue," LePage said. "It is an operational risk that affects every department, every employee, and every interaction with residents, vendors, and business partners."
As staffing challenges and competing priorities continue to affect many housing organizations, maintaining strong cybersecurity practices requires an intentional and organization-wide effort.
##### Hear from Doug Fleming, executive director of the Lansing Housing Commission, on the devastating impact a cyberattack has on a housing organization, and the importance of cybersecurity coverage.
## Building a culture of secure behavior
If awareness alone is not enough, what works? According to Konopka, organizations should focus on making cybersecurity practical, relevant, and manageable.
Rather than relying solely on annual training requirements, organizations can reinforce key messages throughout the year with shorter, more targeted communications. Sharing examples of current scams, discussing recent incidents, and providing actionable guidance can help employees understand how cybersecurity applies to their day-to-day responsibilities.
Organizations should also look for opportunities to simplify security processes whenever possible. The easier it is for employees to follow secure practices, the more likely those behaviors are to become routine.
"Good cybersecurity is ultimately about people," Konopka said. "Technology plays an important role, but creating a culture where employees understand their role in protecting the organization is what makes the biggest difference."
## Turning awareness into action
[The National Cybersecurity Alliance's research](https://www.staysafeonline.org/) highlights an important reality: awareness and action are not the same thing. While employees may understand cybersecurity risks better than ever before, growing complexity, competing priorities, and information overload can make it difficult to consistently apply that knowledge.
For housing organizations, the path forward is not simply providing more cybersecurity training. It is creating an environment where secure behaviors are practical, supported, and reinforced throughout the year. By combining education, leadership support, and user-friendly security practices, organizations can help close the gap between knowing what to do and actually doing it.
## Strengthen your organization's cybersecurity posture
Cybersecurity awareness is only one part of building a strong defense against evolving threats. HAI Group offers resources and guidance to help housing organizations strengthen cybersecurity practices, reduce risk, and keep staff informed.
### **Explore cybersecurity resources**
Visit HAI Group's Cybersecurity Resource Center for articles, tools, webinar recordings, and practical guidance designed specifically for housing organizations.
[](https://blog.haigroup.com/hs/cta/wi/redirect?encryptedPayload=AVxigLKqm9iz%2FkZ1gt0dwpbmq616LdePDtghvkYfNnbaDnsY4Y0wbzV9kiA9XGJ%2Fg1r5oNBeoJ7jGscl6FdG8iHP27tgrFdc6Qd7nLiVV0u4Iob%2BK1VZ4qWEgySpU1sIQ1%2Fa0BLuxmNF3An1lxLRS869y0OvPnBhir4CaBSymwHte3VV3IGkfL51w9HzvF7m1mUFzNjy8je9uYJhuS0fj2v50SAHfID9gLoHFd8SUHnu97ncidpInQ%3D%3D&webInteractiveContentId=215583738161&portalId=20790879)
### **Access the Cybersecurity Center**
Explore cybersecurity best practices, threat information, training resources, and tools to help your organization build resilience against cyber threats.
[](https://blog.haigroup.com/hs/cta/wi/redirect?encryptedPayload=AVxigLK3vyQ%2BBbz9XCjCxg0YyvT%2FEs3mpLjvO7KKWQvB0aM8i9kxlyw4ruWM7JN5T2OXgAC0IMh%2BZwBhgorq3PomKSeOmMX4XxARpy8%2Bbsx9IlFCwFSSg83Sx1VkvwlrGaXTi7VexlZmMWTR8j1T3X0L2%2FQG5XFf6Zkxq8A6TS9omAxHkrBY%2FsUkBNm1wrlbdaZT19%2BTJN1XzWgXi5AGi28O3roNhSsECrnCryOyzFy2qBySNoFe6%2BR6z4Bl37s%3D&webInteractiveContentId=202632084796&portalId=20790879)
### **Connect with your risk control consultant**
Looking for guidance specific to your organization? Reach out to your HAI Group Risk Control Consultant to discuss training opportunities and risk management strategies.
[](https://blog.haigroup.com/hs/cta/wi/redirect?encryptedPayload=AVxigLK%2FDNtAUe2XCAtLjQxfzGOOmvGyPosCifqPGF8Ws09Tmq7RSktswMXEsb9SzDs7%2B2evEmh3MG%2FF3V8EF8ftnyrBogVlK%2FKlEpR35VEWzOuVP%2FN1RVS%2BGn3wdTI1%2BtwF%2Bl%2Blfmn3yU%2BXim18T13B6fsdsJJh1dajC%2FaJ4rDExF6njWdjh2b%2BXCr7PjWUaAkNKIr1073fCybTmzA%2Be0oTmWY%3D&webInteractiveContentId=170093881147&portalId=20790879)
The information presented is for general reference only. HAI Group makes no representation or warranty about the accuracy or applicability of this information for any particular use or circumstance. Your use of this information is at your own discretion and risk. HAI Group and any author or contributor identified herein assume no responsibility for your use of this information. You should consult with your legal, professional or subject matter advisor before implementing any new strategy or policy.
HAI Group® is the registered trademark of Housing Authority Risk Retention Group, Inc. and its related companies. For a complete list of HAI Group companies, visit www.haigroup.com. Products or services may not be available in all jurisdictions. Certain property and casualty coverage may be provided by a risk retention group or a surplus lines insurer or by a third party. Risk retention groups and surplus lines insurers do not participate in state guaranty funds and their insureds are not protected by such funds.
Don't Miss This
## Related Content
[](https://blog.haigroup.com/strengthening-cybersecurity-culture-how-public-housing-organizations-can-embrace-cybersecurity-awareness-month)
- June 23, 2026
### [Strengthening Cybersecurity Culture: How Public Housing Organizations Can Embrace Cybersecurity Awareness Month](https://blog.haigroup.com/strengthening-cybersecurity-culture-how-public-housing-organizations-can-embrace-cybersecurity-awareness-month)
October 1, 2024
Given that public and affordable housing organizations play a critical role in our communities—providing essential...
[Read more](https://blog.haigroup.com/strengthening-cybersecurity-culture-how-public-housing-organizations-can-embrace-cybersecurity-awareness-month)
[](https://blog.haigroup.com/powerful-and-free-new-cybersecurity-resource-for-public-housing-agencies)
- June 23, 2026
### [Powerful (and Free!) New Cybersecurity Resource for Public Housing Agencies](https://blog.haigroup.com/powerful-and-free-new-cybersecurity-resource-for-public-housing-agencies)
February 8, 2024
The housing industry continues to be an attractive target for cybercriminals, who can do real damage to your agency in...
[Read more](https://blog.haigroup.com/powerful-and-free-new-cybersecurity-resource-for-public-housing-agencies)
[](https://blog.haigroup.com/cybersecurity-awareness-month-is-your-affordable-housing-organization-cybersmart)
- June 23, 2026
### [Is Your Affordable Housing Organization Cyber Smart?](https://blog.haigroup.com/cybersecurity-awareness-month-is-your-affordable-housing-organization-cybersmart)
October 10, 2024
October is Cybersecurity Awareness Month, and cyberattacks are on the rise. Whether you're managing properties,...
[Read more](https://blog.haigroup.com/cybersecurity-awareness-month-is-your-affordable-housing-organization-cybersmart)
- [Online Privacy Policy](https://www.haigroup.com/privacy-policy/)
- [California Privacy Rights](https://www.haigroup.com/wp-content/uploads/2024/11/HAI-Group-CA-Privacy-Rights-Notice-1.pdf)
- [Terms of Use](https://www.haigroup.com/terms-of-use/)
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Ally Modugno | Marketing Specialist | HAI Group",
"url" : "https://blog.haigroup.com/author/ally-modugno"
},
"dateModified" : "2026-06-23T15:04:32.363Z",
"datePublished" : "2026-06-23T15:04:32.000Z",
"headline" : "The Growing Gap Between Cybersecurity Awareness and Action",
"image" : [ "https://blog.haigroup.com/hubfs/Cyber%20Featured%20Image.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.haigroup.com/the-growing-gap-between-cybersecurity-awareness-and-action",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.haigroup.com/hubfs/HAIGroup%20PMS2186C%20400X100-300dpi-1.png"
},
"name" : "HARRG"
}
}
```