INDIANAPOLIS—Lindsey Mote, the cybersecurity administrator at Mountain View Electric Association, gets it. Co-op staff can find cybersecurity training too technical, boring or even useless.

That’s where co-op cybersecurity learning communities come in with phishing derbies, stickers, lunch crews, poster contests and prizes. Mote described how she applied the academic tactic of peer-learning to co-op cybersecurity training at NRECA’s recent Co-op Cyber Tech conference.

A learning community “is not a lecture,” she said. “It’s an open culture with peer support.”

Communities are formed when employees with common learning goals collaborate, share and learn from one another, she said. At Mountain View, learning communities on cybersecurity have taken off with enthusiasm, turning training that can otherwise be mundane into activities with goals and prizes.

“Participants enjoy learning from each other, and the co-op makes an investment in their personal growth,” she said. “Participants feel comfortable sharing mistakes and personal experiences regarding cybersecurity, and we all learn from that.”

But how can co-ops get there, especially on limited resources?

Mote, one of NRECA’s 12 founding Cyber Champions, offered multiple avenues she put into practice, including a “phishing derby,” where employees receive phishing emails for four straight weeks and either earn points for reporting them or lose points for clicking on links. Some staff formed teams, and the winners received certificates and medals.

A cybersecurity poster contest, where the winner’s poster was displayed around the co-op, garnered a lot of participation.

Other community learning activities around cybersecurity include lunch-and-learns on books, movies or TV shows that feature cybersecurity and group discussions on how to be cyber-safe at home.

Recognizing employees with shout-outs, stickers or gift cards for especially good phish-email detection or other cyber wins also boosts morale and helps keep cybersecurity top-of-mind, Mote said. But she stresses that punishing staff for phish clicks is never a good idea—the point is to learn from mistakes in the simulations to prevent them from happening in the real world.

In addition to being creative, she said, it is also important for co-ops to follow the simple tenets of learning communities:

• Keep participation voluntary to encourage staff to join.

• Let staff know that the co-op supports the community so they will feel free to participate.

• Offer starting points, such as discussion topics or activities, and allow participants to take it from there.

• Ensure participants feel safe to talk about aspects they don’t understand and mistakes they have made.

Since putting learning communities into practice at the Falcon, Colorado-based co-op, Mote said employees are much more engaged in cybersecurity training and even talk about it in the regular course of their day.

“That’s success when people are talking about cybersecurity without prompting,” she said.