Cebu Pacific

Once the decision to implement the KnowBe4 Platform was made, the security director handed the deployment and management of the program over to two other employees: Bernadette N. Uycoque, manager for security operations, and Jan Kirby L. Cruz, manager for IT governance, risk and compliance.

“We knew we needed to address cybersecurity head on and in a big way, so we took swift action to finance and deploy a layered approach across the organization,” Uycoque says, “In doing so, we prioritized security awareness and training and KnowBe4 became foundational in our strategy to build a strong cybersecurity culture.”

With the successful roll out and usage of KnowBe4, two Cebu Pacific subsidiaries have also deployed the platform. Today, more than 6,000 Cebu Pacific users are trained and tested on the KnowBe4 platform.

An Evolving Cybersecurity Awareness Program

Cebu Pacific needed to understand how likely their users were to click on a phishing link, something KnowBe4 refers to as the Phish-prone™ Percentage (PPP).

Upon deploying KnowBe4 in 2017, the company conducted a baseline phishing test that revealed a staggering 81% PPP, underscoring significant vulnerabilities. The company implemented regular security awareness training to educate employees about cyber threats, and tested their knowledge and skills frequently.

Over the past eight years, Cebu Pacific has expanded its training significantly, using a combination of regular cybersecurity proficiency assessments, targeted phishing tests and specialized “clicker” training for those employees prone to phishing attempts.

Today, Cebu Pacific conducts an annual Security Awareness Proficiency Assessment (SAPA) and semi-annual awareness training focused on emerging risks and needed skills identified by the SAPA testing. It also tests users’ skills with quarterly phishing tests and provides extra quarterly “clickers” training for users who have struggled to identify simulated phishes.

“With KnowBe4, we have reduced our PPP from a high of 81% to a mere 6% today. We’ve evolved from basic annual training to a comprehensive and highly customized program that’s tailored to our needs,” Cruz says. “Training and testing are run directly through the KnowBe4 Platform, which makes it easy for users to log in and participate. We can also easily run reports and show our results which our management team likes to see.”

Boosting Employee Engagement and Confidence

Initially, Cebu Pacific’s HR team expressed concerns, worrying that employees might experience training fatigue from the regular training and testing initiatives. However, feedback from employees highlighted strong enthusiasm for the program and positive engagement resulting in a 96% completion rate for the SAPA testing and a comparable 97% of employees completing security awareness training. A recent cybersecurity culture survey confirmed that employees now perceive cybersecurity training as essential and beneficial, rather than burdensome.

“Employees expressed gratitude for acquiring valuable cybersecurity knowledge they could apply not just at work, but also in their personal lives,” Cruz says.

Additionally, internal communication materials and posters from KnowBe4’s ModStore have been widely used and customized to further reinforce cybersecurity messages throughout Cebu Pacific’s offices.

Transformative Phishing Awareness Results

The impact of Cebu Pacific’s training initiatives has been remarkable. The company’s PPP plummeted from a high of 81% in 2017 to just 6% by 2024.

“Our consistent use of KnowBe4 has significantly improved our employees’ awareness and vigilance,” Cruz says. “The continuous decline in our Phish-prone™ Percentage demonstrates a successful cultural shift towards cybersecurity awareness.”

Employees now proactively use KnowBe4’s Phish Alert Button to report suspicious emails, streamlining investigations and allowing the security team to respond quickly. “Even though our current response to these alerts is manual, the Phish Alert Button has empowered employees to participate actively in cybersecurity,” Uycoque says. “This collaboration has tremendously improved our defensive posture.”

KnowBe4 has been such a success that two Cebu Pacific subsidiaries—1Aviation Groundhandling and Aviation Partnership Philippines—have started using the platform.

“We deployed KnowBe4 across two other subsidiaries representing 2,000 additional users,” Cruz says. “Our management team has been extremely pleased with KnowBe4 and sees it as a strategic investment in our future.”