At a Glance
The National Treatment Purchase Fund (NTPF) is Ireland's public sector body for national public hospital waiting list data, handling sensitive patient records from every public hospital in the country. After the 2021 HSE cyber attack, Director of ICT Eoin Darcy changed the organisation's security philosophy from blaming users to treating them as its best line of defence — building a culture, not just a training programme, that now drives 99.4% participation as a board-reported KPI.
Key outcomes
- 99.4% training participation, tracked by the Audit and Risk Committee as a listed KPI against a 95% target
- Sustained above 99% since rollout, with every staff member from the CEO down completing the same training at the same cadence
- NIS 2 compliance evidence built in — management and board buy-in is a requirement, and usecure's reporting makes it provable
- Low admin, with courses delivered automatically on whatever cadence the team sets
The Challenge
The users were the problem. That was the problem.
Like most organisations, NTPF defaulted to blaming users for clicking the wrong link.
“The users were the problem. The users were the ones who clicked on links. They were the ones who made the mistakes. They were the ones who let the bad guys in.”
As Eoin puts it, that wasn't particularly empowering for the users — and it wasn't preventing anything either. Blame is a diagnosis, not a defence.
Before usecure, information security training at NTPF was a single annual session: Eoin talking to the team for an hour or two at induction. “It wasn't uppermost in their minds.” A tick-box exercise standing in for a defence against the most common breach vector in the public sector.
Then came the 2021 HSE cyber attack, which almost brought down the Irish health system. It started with one user clicking one link. NTPF holds sensitive patient data from every public hospital in the country.
“You can only be unlucky once and things can go very wrong.”
The Solution
Flipped it totally on its head
The flip was philosophical, not technical. Instead of treating users as the liability, NTPF recast them as the last line of defence.
“We sort of looked at that again and flipped it totally on its head and went out and changed our message totally to our staff — that they're actually the last line of defence and the best line of defence. They are our human firewall.”
NTPF's disaster recovery provider, Savenet, recommended usecure. “We had a quick trial proof of concept with Savenet on it and really liked it.”
Three objections, three answers, one platform:
“The characters in the videos are very relatable. The administration is quite low, courses get automatically delivered on whatever cadence you want. And from a security viewpoint, they worked seamlessly with our own controls. Those were the three biggest things that made us pick usecure and keep using them.”
The Results
Culture, not courses — and a number the board now tracks
usecure is the floor. Culture is everything built on top of it: a Teams channel for information security news, rotating posters around the office, Cyberto mouse mats on every desk. Every Friday each director gets a report showing who is behind. And the CEO does the training like everyone else.
- 99.4% participation as a board KPI. The Audit and Risk Committee tracks training participation as a listed KPI. Target 95%. Sustained above 99% since rollout.
- Management buy-in, CEO down. Every staff member from CEO to frontline completes the same training at the same cadence. Nobody wants to appear on the non-compliance list.
- NIS 2 compliance evidence built in. Management and board buy-in is a NIS 2 requirement. usecure's reporting makes it provable, not just performed.
“I'll never be comfortable about cyber security. It'll always be a major part of our work in improving and improving and improving in every area. But at least I know that the training aspect is being well covered at the moment.”
How They Did It
A whole culture around information security
“We realised that while usecure is excellent, we wanted to create a whole culture around information security, either using the characters, but also just increasing the awareness of information security around the whole organisation.”
- Characters that connect. Animated baddies, goodies and the “poor unfortunate who always gets caught”. Cyberto became a pantomime villain in the organisation, blamed for everything that goes wrong.
- Low admin, automatic cadence. Courses get delivered weekly, monthly or at whatever cadence you want, with no administration involved. The IT team spends its time defending, not chasing sign-offs.
- Worked with the existing stack. No blocked courses, no conflicts with NTPF's security controls. Savenet handled implementation, bespoke campaigns and feature requests.
Eoin's advice to IT directors
“Don't rely solely on the training mechanism. If it's just another training course, it loses its effect. It needs to be front and centre and in people's minds all the time — because as soon as it goes out of someone's mind, that's when they click on that link you don't want.”
Start your own story
See what usecure can do for your organisation: security awareness training your staff actually engage with, board-level reporting, and low admin with high adoption — from frontline users to the CEO.