Exercise: Developing a Risk Awareness Campaign
©Kayne McGladrey – Get the full book “Cyber Risk is a Myth”
This step-by-step exercise helps design targeted risk awareness initiatives:
1. Define campaign objectives:
Specific behaviors you want to encourage or discourage:
- Discourage password reuse across e-commerce, email, and business platforms for customer-facing accounts
- Encourage unique password generation for every customer account holder
- Discourage shared administrative credentials among the e-commerce digital team
- Encourage MFA enrollment for all staff accessing BigCommerce, Klaviyo, Cloudflare, Shopify POS, Affirm, or Synchrony portals
Measurable outcome goals:
- Reduce reused-password customer accounts by 80% within 12 months (baseline: Month 0 pre-launch credential scan conducted October-November 2026; historical 2024 figure of 3,400 detected reused accounts serves as reference only)
- Achieve 100% MFA enrollment across six administrative platforms (12 administrative accounts total) by Week 6 of Q2 kickoff year
- Achieve a 40% completion rate among customers notified of a reused password, measured as those who change their password within 30 days of notification (baseline established at the Month 1 notification wave)
Success criteria and evaluation methods:
- Quarterly credential hygiene scans using the same breach-data monitoring approach that identified the initial 3,400 compromised accounts
- Platform-native MFA enrollment dashboards from all six platforms (BigCommerce, Klaviyo, Cloudflare, Shopify POS, Affirm, Synchrony), reviewed weekly until the 100% target is met, then quarterly
- Cloudflare bot-mitigation telemetry tracked for credential-stuffing attempt volume reaching at least 20% below the Month 0 baseline by the second quarterly scan (Month 6 post-launch)
- Administrative account compromise treated as a maintained control rather than a campaign outcome: zero recorded admin compromises, supported by the leading indicators of full MFA coverage (12 of 12 accounts), quarterly credential-audit findings remediated within 30 days, and monthly anomaly review of admin login logs
2. Segment your audience:
Primary audience groups with different needs:
| Audience Segment | Size Estimate | Primary Contact Channel | Current Security Posture |
|---|---|---|---|
| E-commerce account holders (customers) | Approximately 148,000 customer records across fragmented databases (pre-consolidation count, includes duplicates; will be restated after deduplication completes) | Klaviyo email, transactional messages, password reset pages | Naïve (4Ns model): reactive, crisis-driven behavior evident from 2024 reused-password discovery |
| Internal digital team and administrators | Four to eight staff members holding 12 administrative accounts across six platforms (approximately 1.5 to 3 accounts per person depending on role assignments) | Monthly operations meetings, direct onboarding sessions | Novice-to-Normalized: responsive to incidents but no proactive credential audit practice |
Current awareness levels and specific risk exposures:
E-commerce account holders:
- Awareness level: Low. Customers generally treat passwords as routine account access tools without recognizing credential reuse as a cascade risk.
- Risk exposures:
- Account takeover exposing order history, saved shipping addresses, wish lists, and payment information stored in BigCommerce profiles.
- Financing exposure is relevant where Affirm or Synchrony orders are active; management reporting puts financing penetration at roughly 35% of e-commerce revenue.
- Detection methodology checks against common breach repositories including HaveIBeenPwned and local breach-notification databases; a “match” occurs when customer email/password combination appears in any monitored dataset.
Internal digital team and administrators:
- Awareness level: Moderate. The team implemented Cloudflare bot mitigation and forced password resets following the 2024 incident but lacks formal MFA enforcement policy.
- Risk exposures: A single compromised admin credential grants access to the customer databases (approximately 148,000 records prior to consolidation), marketing automation data, and checkout infrastructure. Apply the SolarWinds lesson via mandatory separation of production and test credentials, mandatory unique passwords per platform, and quarterly access reviews with documented remediation timelines.
Motivators and barriers for each group:
E-commerce account holders:
- Motivators:
- Personal protection of order history and saved delivery details
- Avoidance of fraud on financed purchases where monthly payments remain active
- Desire for uninterrupted shopping experience during peak seasonal periods (holiday furniture purchases, clearance events)
- Barriers:
- Retail customers have no institutional mandate enforcing password practices
- Security messaging competes with promotional volume from existing Klaviyo campaigns
- Password habits respond to personal relevance and repetition, since no employer policy applies
Internal digital team and administrators:
- Motivators:
- Professional accountability for revenue channel integrity
- Career value from demonstrable security competence
- Protection of the platform they built since 2020
- Barriers:
- Small team operating with lean resources
- Potential perception that MFA adds friction to daily operations
- Possible assumption that security falls outside core responsibilities given no dedicated security function exists within the 150-200 employee company
3. Develop tailored messaging:
Core messages addressing each group’s specific risks:
E-commerce account holders: “One unique password protects your order history, saved addresses, and any active financed purchases.”
Supporting points:
- Reused passwords expose you even when retailers follow best practices
- Compromised credentials enable attackers to access order tracking and return histories
- Account takeovers can interrupt financing payments processed through Affirm or Synchrony
Internal digital team and administrators: “Every admin password is a key to the entire customer database. Uniqueness and MFA on those keys is non-negotiable.”
Supporting points:
- A single compromised credential converts isolated customer incidents into platform-wide breaches
- Administrative access to BigCommerce, Klaviyo, and Cloudflare sits at the intersection of customer data, marketing automation, and traffic protection
- Internal controls must match documented commitments, since gaps between policy and practice create liability
Adapt delivery methods to each group’s preferences:
E-commerce account holders:
- Transactional email integration: Insert security reminder into password reset confirmation messages and post-purchase receipts (leverages existing Klaviyo infrastructure at minimal marginal cost)
- Seasonal timing: Align security reminders with high-volume purchasing periods (graduation and early-summer refresh, holiday furniture, quarterly clearance events) when customer engagement peaks
- Tone: Benefit-focused, avoiding fear-based language that may reduce open rates or trigger spam filters
Internal digital team and administrators:
- Operations meeting integration: Add monthly security checkpoint agenda item to existing standing meetings
- Hands-on MFA enrollment sessions: Scheduled during the same window as platform maintenance to minimize workflow disruption
- Audit ritual: Quarterly admin-credential review embedded into the existing quarterly scan timeline for consistency
Incorporate real examples relevant to each audience:
E-commerce account holders:
- Reference the 2024 incident that required 3,400 password resets without revealing specific technical details or customer names
- Frame the message around the customer’s own data and purchases
Internal digital team and administrators:
- Reference the SolarWinds case where password policy existed on paper but the production server used “solarwinds123”; use as a cautionary example of control gaps between documentation and practice
- Note the Cloudflare bot mitigation deployment as an example of effective technical response, paired with the reminder that customer-side defenses do not protect against admin-credential compromise
4. Create a multi-channel communication plan:
Appropriate communication channels for each audience:
E-commerce account holders:
| Channel | Frequency | Owner | Status |
|---|---|---|---|
| Klaviyo email flows (post-purchase receipt) | Per transaction | Marketing automation lead | Active; add security module |
| Password reset confirmation page | Per request | E-commerce developer | Active; insert banner |
| Promotional newsletter inserts | Quarterly | Digital marketing | Planned; align with seasonal peaks |
| SMS (for opted-in customers) | Deferred; decision due Week 4 | Marketing automation lead | Pending consent review outcome; resource contingency reserved if triggered |
Internal digital team and administrators:
| Channel | Frequency | Owner | Status |
|---|---|---|---|
| Monthly operations meeting security checkpoint | Monthly | E-commerce director | Active; new agenda item |
| Quarterly admin-credential audit | Quarterly | IT lead (assigned) | Planned; first audit Month 3 |
| Platform-specific MFA enrollment guides | As needed | IT lead (assigned) | Drafting; BigCommerce guide due Week 2, remaining platform guides Weeks 3 through 5 |
| Weekly MFA enrollment dashboard | Weekly during Weeks 2-6 | E-commerce director | Active; data aggregated for monthly consolidation by IT lead |
Schedule communications to avoid overload:
Customer communications:
- Month 1: Initial notification wave to customers with detected reused passwords, following the baseline scan
- Month 3: First seasonal reminder timed to graduation and early-summer furniture refresh purchases
- Month 6: Second seasonal reminder aligned to quarterly clearance event
- Months 9 and 12: Reinforcement pulses tied to holiday season preparation
- Constraint: Maximum two promotional-security hybrid emails per calendar quarter to maintain deliverability and avoid subscriber fatigue
Internal communications:
- Week 1: Kickoff announcement at monthly operations meeting
- Weeks 2 through 6: Staggered MFA enrollment completion in priority order (BigCommerce, Klaviyo, Cloudflare, Shopify POS, then Affirm, Synchrony)
- Month 3: First quarterly credential audit and progress review
- Months 6, 9, and 12: Continued quarterly audits with trend reporting to executive sponsor
Plan for reinforcement through different formats:
- Email: Primary vehicle for customer-facing messaging
- Visual aids: Simple diagrams showing how credential stuffing works; inserted into password reset pages
- Direct engagement: Hands-on MFA setup sessions for internal team; scheduled as paid time during work hours
- Recognition: Public acknowledgment in company newsletter for teams completing MFA enrollment ahead of schedule, following Security Champion Program principles
5. Establish measurement approach:
Key metrics aligned to behavioral objectives:
| Metric | Definition | Baseline | Target | Reporting Cadence |
|---|---|---|---|---|
| Reused-password customer accounts | Accounts flagged by breach-monitoring scan matching known compromised credential sets | Month 0 pre-launch scan (October-November 2026); historical 2024 reference: 3,400 accounts | 80% reduction from Month 0 baseline by Month 12 | Quarterly; if database consolidation completes mid-campaign, restate baseline with deduplicated count and recalculate remaining reduction target proportionally |
| Notified-customer password change completion | Share of customers notified of a reused password who complete a change within 30 days of notification | Established at Month 1 notification wave | 40% by Month 12 | Per notification wave |
| Admin MFA enrollment rate | Percentage of the 12 administrative accounts with MFA enabled across six platforms (BigCommerce, Klaviyo, Cloudflare, Shopify POS, Affirm, Synchrony) | 0% (no enforcement policy exists) | 100% (12 of 12) by Week 6 | Weekly during enrollment window, then quarterly |
| Credential-stuffing attempts blocked | Count from Cloudflare bot-mitigation logs of credential-stuffing patterns | Month 0 baseline from 30 days of logs immediately before launch | At least 20% below Month 0 baseline by Month 6 (second quarterly scan) | Monthly |
| Maintained control: admin account compromise | Leading indicators: MFA coverage, quarterly credential-audit findings remediated within 30 days, anomaly review of admin login logs | Zero recorded admin compromises through 2024 | Zero sustained, with all leading indicators green | Ongoing alert; monthly indicator review |
Baseline measurements before campaign launch:
- Conduct full credential hygiene scan of the customer databases (approximately 148,000 records prior to consolidation and deduplication) using the same methodology that identified the 3,400 reused passwords in 2024. This Month 0 scan replaces the 2024 historical figure as the actual baseline for campaign targets.
- Document current MFA status across all 12 administrative accounts on all six platforms; run individual platform reports and compile consolidated baseline
- Capture the Month 0 credential-stuffing attempt volume from 30 days of Cloudflare bot-mitigation logs immediately preceding launch
- Note: The deletion/opt-out completion metric referenced in prior planning phases has been deferred; consolidation of fragmented customer databases remains in progress and will be measured under a separate loyalty program initiative. Upon database consolidation completion, the record-count denominator will be restated to reflect deduplicated counts, and affected metrics (reused-password percentage, contact rates) will be recalculated with proportional adjustment to remaining reduction targets.
Regular measurement points to track progress:
- Weekly: Internal MFA enrollment dashboard review by e-commerce director during operational check-ins; raw data compiled by IT lead for monthly consolidation
- Monthly: Consolidated report including bot-mitigation telemetry, admin-login anomaly review, and leading-indicator status presented at operations meeting
- Quarterly: Formal assessment against targets, including reused-password scan results and trend analysis; executive sponsor receives summary report
- Annual: Full program evaluation determining whether objectives were met, whether continuation or modification is warranted
6. Implement, measure, and refine:
Launch campaign with high-visibility kickoff:
- Kickoff date: Week 1 of Q2 (scheduled to precede loyalty program consolidation work; campaign serves as prerequisite privacy control)
- All-hands announcement: Company-wide meeting to frame campaign as foundational to upcoming loyalty program launch; emphasize that customer trust depends on credential protection
- Executive sponsor: CEO (identified during planning; formal endorsement required for internal resource allocation)
- Marketing materials: Password reset banners live on Day 1; first Klaviyo security module deployed by Day 3; internal MFA guides distributed by Week 2
Collect feedback and measure early results:
- Customer-side feedback collected through Klaviyo open rates, click-through rates, completion rates on notification waves, and unsubscribe spikes following security-module emails; thresholds established for intervention if engagement drops below baseline
- Abnormally high password-reset volumes are reviewed alongside bot-mitigation telemetry each month, since reset spikes can indicate compromise or confusion instead of healthy engagement
- Internal feedback gathered through one-on-one conversations during MFA enrollment sessions; anonymous suggestion channel available via existing HR feedback system
- Early metrics: First weekly MFA enrollment dashboard (due end of Week 1), first monthly bot-mitigation trend report (due Month 1), first quarterly credential scan (due Month 3)
Adjust approach based on initial outcomes:
- If customer engagement with security emails falls below 15% open rate after the first two pulses: revise subject lines, move security module to transactional-only channels, or revisit the SMS channel if the Week 4 consent review permits it and resource contingency is approved
- If internal MFA enrollment stalls at 70% or below by Week 4 (midpoint of the enrollment window): escalate to mandatory policy with access revocation for non-enrolled admin accounts at the Week 6 deadline; assign IT lead to conduct hands-on setup support
- Pre-authorized vendor expansion trigger: If the first credential scan (Month 3) reveals that more than 10% of compromised accounts trace to vendor-originating data leaks, this campaign expands to include partner-facing messaging and accelerated vendor addendum enforcement. Escalation approval rests with executive sponsor upon Month 3 scan results.
Constraint noted and contingency plans:
- The company operates with a lean digital team of four to eight people holding 12 administrative accounts.
- Security campaign activities compete with operational priorities (e-commerce storefront maintenance, POS integration, promotional campaign execution).
- Budget allocation for external security awareness platform licenses is not approved; campaign must leverage existing in-stack tools (Klaviyo, Cloudflare, platform-native features).
- Estimated effort for MFA enrollment and quarterly audits totals approximately 2-3 hours per staff member over the six-week enrollment window.
- If Week 4 engagement thresholds trigger SMS channel activation or escalated support requirements, resource contingency will be submitted to executive sponsor at the Month 3 quarterly review for approval.
