Scenario: Saudi Aramco’s board of directors views cyber risks as a business risk of paramount priority. To ensure it is prioritized throughout the organization, cybersecurity must be reported upon and overseen by the board of directors and executive management, to drive cultural resilience and accelerate risk-mitigation efforts. To enable these changes, the board established a corporate cyber-risk management function to identify, assess, manage and report on cyber risks, and integrated this function in the enterprise risk-management organization. To build a resilient culture, Saudi Aramco then established the Awareness and Behaviour Management function to create a cyber-aware culture, and implemented cyberattack simulation programmes tailored to various stakeholder segments, including executive management, to train them on how to respond and withstand social engineering and attack attempts. Key takeaway: This approach has resulted in a notable increase in corporate awareness of cybersecurity and resilience against social engineering tactics.