Five years of sustained behaviour change:
what a true cyber security partnership looks like

How a large New Zealand Critical National Infrastructure organisation embedded cyber safety into its culture, making secure behaviours a natural part of everyday decision-making.

At a glance

Sector
Critical National Infrastructure

Organisation
Large New Zealand organisation, 1,000+ staff

Services
Mindshift Foundation, Momentum and Partner

Partnership since
May 2021

The challenge

In 2021, a large New Zealand Critical National Infrastructure organisation didn’t have a cyber security awareness programme. Staff signed an annual code of conduct and that was the extent of it. Nothing was tailored, nothing was ongoing, and nothing was measured.

The organisation's workforce was not simple to reach, spread across corporate, field-based and call centre roles, each with different access to computers and different amounts of time available for training. Finance and executive staff carried a particular risk, regularly targeted by whaling attempts designed to look like they came from inside the business.

The organisation wanted more than a training module. It wanted a genuine shift in how its people thought about cyber risk, and a long-term partner who understood its culture well enough to help build that shift gradually, rather than impose it all at once.

Establishing the starting point

The relationship began in May 2021, and it did not start with a rigid methodology or a fixed roadmap. It started with listening. Mindshift worked with the organisation's security team to understand its top human risks, its culture, and the practical realities of training a workforce spread across offices, field sites and call centres.

That early period set the tone for everything that followed. Rather than delivering a one-off programme and moving on, Mindshift stayed close to the organisation, building a depth of institutional knowledge that grew year on year. Five years on, that depth of understanding is what allows Mindshift to contribute at a strategic level and respond quickly when the security team needs support.

Turning strategy into a programme that works

As the relationship matured, Mindshift designed and delivered a structured awareness programme built specifically around the organisation's context. This included foundation and annual refresher eLearning modules, a quarterly Cyber News publication, and ongoing awareness campaigns. The campaign topics included social engineering, password hygiene and keeping information safe day to day.

Much of this content was delivered through, an intranet hub built to give staff a single, easy place to find guidance, report concerns and understand what to do if something felt wrong. Animated training content, tip sheets and intranet articles were tailored to the organisation's own scenarios and language, so the material felt like it belonged to the business rather than being bought off the shelf.

Mindshift also inspired the concept behind the Cyber Standards Buddy, an AI powered tool designed to help staff apply security standards to their own projects. The organisation took that concept and built and manages the tool independently, a good example of how ideas from the partnership have taken on a life of their own inside the business.

Lasting change, consistently delivered

The progression from Momentum to Partner was gradual, built on years of shared knowledge and mutual trust rather than a formal handover. Under the current Partner agreement, Mindshift works fixed hours each month as part of the organisation's cybersecurity team, providing ongoing content ideation and creation, strategic guidance and ensuring tactical delivery against plan and ad hoc campaigns.

Phishing simulations and gamification are managed entirely by the organisation through a third-party platform, and Mindshift's role here has always been strategic and advisory. Under the Partner agreement, that role is deepening. Mindshift is now working more closely with the security team on recommendations for training and coaching, informed by the organisation's own phishing report data.

Under the Partner agreement, that regular, ongoing rhythm of work is what sets this stage of the relationship apart from a standard external engagement.

Outcomes: what changed

Five years of sustained work has produced measurable change, not just in numbers, but in what people actually do. Earlier last year, an employee received an automated alert about unusual login attempts on their account. Their password and multi-factor authentication had already done their job. The account stayed secure, and no further action was needed.

That is the outcome the whole programme has been building towards. The organisation has progressed steadily against the SANS Security Awareness Maturity Model, moving from a compliance focused starting point to a culture where cyber security awareness is embedded in everyday behaviour, not treated as an annual obligation.

The organisation's own commitment to this work has been recognised externally. That recognition belongs to the organisation and the people who built and championed the programme internally. Mindshift is proud to have supported that journey as a partner throughout. Behind the numbers and the recognition sits something less visible but just as important: a long-term, trust-based working relationship. Five years of consistency is itself a demonstration of what sustained behaviour change requires, not a single campaign, but a patient, sustained partnership.

Voices

The security education session was excellent and well received. It stood out because it wasn't a generic awareness module. Instead, the session was designed specifically with finance in mind, showing real understanding of how our people think and work. The finance team found the session highly engaging and impactful. It sparked further conversations and increased awareness of cyber risks, which is exactly the outcome we need.

Chief Financial Officer

The tailored nature of the security awareness training was awesome. The sessions were engaging, highly informative, and actionable, directly addressing the evolving threats we face in our roles, particularly phishing and social engineering. Our teams now feel more confident, positive, and empowered to identify and respond to these risks, which is making a noticeable difference in our daily operations.

Service Delivery Manager

Working together with this organisation to continue the momentum they have worked consistently to build, and to achieve their goals, is a privilege. The natural progression from Momentum to Partner means their goals are now our goals, and that is what makes a true partnership.

Five years of sustained behaviour change: what a true cyber security partnership looks like