About Bolton NHS Foundation Trust

Bolton NHS Foundation Trust is a major provider of hospital and community health services in the North West Sector of Greater Manchester.

It delivers services from the Royal Bolton Hospital and also provides patient care in the community at health centres and clinics as well as services such as district nursing and intermediate care.

The Trust has six big ambitions that describe what it will do over the next five years:

• To give every person the best treatment, every time
• To be a great place to work
• To spend its money wisely
• To make its hospital and its buildings fit for the future
• To join-up services to improve the health of the people of Bolton
• To develop partnerships across Greater Manchester to improve services

‍

Introduction: the most targeted sector in the world

Cyber threats are a significant challenge for health and social care organisations. The industry experiences the highest number of data breaches annually.

The wealth of data available on NHS networks and the potential impact of data unavailability makes the sector very attractive to cyber criminals.

Furthermore, as patient information is often available to a wide scope of personnel, the risk of an accidental breach is also increased. To minimise these risks, healthcare providers like Bolton NHS need to maintain a robust information security posture and have tried-and-tested plans in place should a breach occur.

‍

The challenge: seamlessly fitting in with people’s professional lives

Bolton NHS had become frustrated with its traditional tick-box cyber security training system, which the Trust suspected hadn’t made an impact on human cyber risk. The programme was widely regarded as dry and unengaging, and an inconvenience. In 2019, Bolton NHS reached out to explore alternative platforms.

Top of the priority list was tackling low engagement. The organisation needed a system that wouldn’t become a chore for staff – a platform that staff would actually find useful, interesting, and applicable for work and home.

Another key consideration was flexibility. With staff spread across a diverse range of roles – doctors, nurses and midwifery professionals, support and administrative professionals, and medical and dental professionals – it needed a platform with modular, adaptive content.

The Trust also wanted a platform that could be easily scaled to the thousands of people. “When you’re training thousands of people, it’s the logistics of training everyone that becomes the issue,” explains Brett Walmsley, CTO of Bolton NHS. “Do you make it mandatory? Do you send lots of phishing emails? Do you run expensive training days? The NHS is just so big.”

When the Trust came across CybSafe, it stood out as the right fit.

‍

Getting started: enabling key staff & ensuring engagement

Bolton NHS began using the CybSafe platform by enabling some key staff to use the bespoke healthcare modules and in-built phishing simulation software.

This gave the Trust accurate measures of what their test group understood about security in general, their individual security habits and their attitude towards security.

Not long after, CybSafe was rolled out more widely across a number of different user communities – and the platform quickly made an impact on staff’s awareness, their security behaviours, and the overall cyber security culture of the organisation.

‍

The impact: making a real difference, with the data to prove it

As staff have progressed through the platform, the knowledge gaps identified in CybSafe’s initial rollout have closed, and attitudes towards cyber security and security awareness have flipped.

What was once resented is now appreciated and valued by staff, and the Trust’s people are actively using what they’ve learnt on the platform and applying it in the real world. “The platform has made a real difference to our people – what they know, how they behave, and even how they think about security. It’s impressive,” says Walmsley. “The platform has even worked on me. I actually use one of the CybSafe quotes as part of my email signature.”

Another dramatic positive for Bolton NHS is the flexibility it has given the organisation in delivering its awareness training.

“CybSafe’s small chunks are much more manageable for our people,” says Walmsley.

With the ability to annotate CybSafe’s specialised modules, as well as CybSafe’s content prioritisation tools, the IT team have a rich tool set which allows them to fine tune and customise how its staff receive CybSafe. “If we want to tailor CybSafe’s modules with additional or different pieces of information to fit the user – whether it’s a director, doctor, or someone in our IT team – we can do that. We can make the training absolutely relevant to different kinds of people with very little effort on our part.”

‍

Conclusion: reduced impact and frequency of people-related incidents

The Trust is now observing noticeable differences in the number of reported incidents since CybSafe has been running. Incidents are now significantly below where they were when using traditional tick-box compliance based training, and significantly below their key benchmarks.

It is currently considering how CybSafe can and will reduce risks with their supply chain. Combined with robust technological defences, CybSafe has decreased security incidents in both frequency and impact.

Our staff can move through the platform at a time and place that suits them. We’re not tied down to specific timeframes.

Brett Walmsley

CTO of Bolton NHS