Your Behavioural Cybersecurity Partner.

Security is a behaviour. We apply behavioural science to how people behave around security, to the Security Champions who spread good behaviour and the Champions Networks that make them a capability.

HEROES.
Security Champions Platform

Manage, engage and scale your security champions network in one powerful platform.

Champion
Management
Engagement
& Campaigns
Insights
& Impact
Learning
& Resources
One platform. Stronger champions. Safer behaviours.

Where are you on the journey?

Getting Started

I am just starting out on building a Security Champions Network and want to set it up for success.

  • Guidance and templates
  • Best practice
  • Launch with confidence
Start here →

Running Your Network

I am already running a Security Champions Network and want to manage, engage and grow it more effectively.

  • Actionable insights
  • Engaged Champions
  • Tools to scale
Find your challenge →

Beyond Awareness

I want to move beyond awareness to achieve real behaviour change across the enterprise.

  • Behavioural science
  • Measure impact
  • A more resilient organisation
Go beyond →

Not sure where you stand? Take the free CyberShield Assessment: 15 questions, an instant score, and what Heroes would do about it.

Where behavioural science meets digital security

Vision: A world where security is intuitive, inclusive, and woven into everyday behaviours.

Mission: We turn the people already shaping security behaviour into a measurable, connected network. Through behavioural science and network analysis, we give organisations a real picture of how security spreads – who influences whom, where resilience is building, and where it isn't – so culture change can be managed rather than hoped for.

About CyBehave →

Evidence-based research

Every framework and feature is grounded in peer-reviewed behavioural science - psychology, behavioural economics, and organisational science applied to cybersecurity.

Privacy-first measurement

CyBehave measures and informs - it does not surveil. This distinction is central to how we design every product.

Human and AI behavioural risk

We address both human behavioural risks and the emerging risks from agentic AI systems within a unified framework.

Founded on the science. Built for practitioners.

CyBehave is founded on behavioural science, and we know that not everyone in cybersecurity is a behavioural scientist or a cyberpsychologist. So we make it our job to bring the science to you in a consumable, practical form: designed for practitioners and scientists alike, and published openly so you can see exactly what our platforms measure, how, and why.

Founder

Andy Wood has built and led a number of Security Champions networks of various sizes inside organisations from private enterprises through to public sector departments. Andy is actively researching how to optimise Security Champions as part of his doctoral research project, as well as having written four books on behavioural cybersecurity. Heroes is Andy's experience turned into a platform. About CyBehave →

The Science →

The peer-reviewed research behind CyBehave - psychology, behavioural economics and organisational science applied to cybersecurity.

The Behavioural Model →

How COM-B and the Behaviour Change Wheel underpin the way we understand, measure and change security behaviour.

Behavioural Convergence Theory →

Whether human behavioural science frameworks can be extended to understand, predict and govern AI agent behaviour in security.

Skills Framework →

The Behavioural Cyber Risk Skills Framework - 30 competencies across 7 domains for building human cyber capability.

Latest from CyBehave

The newest insights, articles and Signals brief - research, practice and the week's briefing in one place.

Insight 7 Sep 2026 8 min read

Seven months on from Moltbook

In February we wrote that AI agents had built their own social network and that your threat model wasn't ready. Moltbook was four days old. ...

Read insight →
Insight 2 Sep 2026 8 min read

The Champion Density Problem

What the science of how behaviour spreads says about how many champions a team really needs, and why your best-connected people may be your ...

Read insight →
Insight 24 Aug 2026 8 min read

Fewer Meetings, More Engagement: What Breakout Action Groups Suggest About Champion Network Structure

Almost every security champions programme starts the same way. Someone sets up a recurring meeting, invites the volunteers, and puts a stand...

Read insight →
Insight 2 Aug 2026 7 min read

We made our website readable by machines

Somebody asked an AI assistant about security champions programmes last month. It gave them an answer. Our name may or may not have been in ...

Read insight →
Insight 23 Jul 2026 7 min read

Security behaviour is a game

I don't mean a game in the trivial sense. I mean it in the formal sense that mathematicians and economists have used for eighty years: a sit...

Read insight →
Insight 20 Jul 2026 8 min read

Eighty-three theories and still nobody locks their screen

There are at least 83 published theories of behaviour change. Michie and colleagues catalogued them in 2014, and between them those theories...

Read insight →
Insight 30 Jun 2026 7 min read

Is this the end of the nudge?

For more than a decade, the nudge has been the dominant idea in applied behavioural science. Change the way a choice is presented, without r...

Read insight →
View all insights →
Article 4 Sep 2026 15 min

Multi-Agent AI Is Replicating Social Psychology

Multi-agent AI research has quietly become a replication project for social psychology. Independent teams keep finding Asch's conformity curves, French and Raven's power bases, Ostrom's norms and Kuran's preference falsification in populations of LLM agents, and they reach for those frameworks because nothing else explains the data. That convergence is what I have been arguing for under Behavioural Convergence Theory (BCT). Here is the evidence.

Read article →
Article 1 Aug 2026 15 min

John in Sales built an app this afternoon

Polish used to be an honest signal that somebody had thought carefully about how a thing was built. It is now free. John in Sales can produce something that looks like enterprise software in an afternoon, and nobody will think to ask, because it looks finished. He will tell you it is only for him. Usually that is true. It changes nothing. The audience was never the risk.

Read article →
Article 28 Jul 2026 18 min

Give Your Agents Something to Read: Building a Normative Repository for Agentic AI

Your agents will never see a poster or absorb culture in a corridor. But they will read a file, take it literally, and act on it thousands of times a day. So write your values down properly. This piece covers building a normative repository: versioned, signed, tested through CI/CD, pulled hourly. And a detection bonus: an agent that quietly stops renewing its norms may be telling you it's compromised.

Read article →
Article 24 Jul 2026 8 min

Fighting fire with fire, when only one side is allowed to burn

Everyone's answer to the frontier AI threat is fight fire with fire. But the attacking agent has no guardrails, no legal review and nobody to answer to. Ours has all three. This week showed what that gap looks like: a company under attack by an AI with the brakes off, unable to get help from an AI with the brakes on. The answer is not removing our constraints. It is making them legible to the machine and survivable for the person.

Read article →
Article 17 Jul 2026 9 min

Security Is Not THE Priority

Security is what the literature calls a secondary task: something you must do on the way to your real goal. A salesperson opens their laptop to close a deal. A nurse logs in to treat a patient. A finance analyst signs in to reconcile month-end. Nobody, anywhere, logs in to do security. And yet we build entire programmes on the assumption that they should.

Read article →
Article 29 Jun 2026 12 min

When did awareness become a science nobody told us we had to study?

For two decades, the role was understood. You came from learning and development or communications. You wrote clear copy, built the training, ran the webinar, and reported the completion rate. It was a craft, and a valuable one. Then we moved the target from knowledge to behaviour, and quietly changed the job.

Read article →
Article 22 Jun 2026 15 min

The expertise gap: why security teams must build behavioural capability

There is a quiet contradiction at the heart of most security functions. They exist because people are the most consequential variable in organisational risk, yet they are staffed, trained and measured almost entirely in terms of technology rather than human behavioural risk. That gap was tolerable when the threat moved at human speed. It is becoming dangerous now that it does not.

Read article →
View all articles →
Signals 14 Sep 2026 8 min

SIGNAL: Week 38 - Trust Falls

Attackers have started dressing up as security itself. This week: Microsoft traces fake IT calls pushing bogus passkey upgrades, Cisco catches scammers talking people into pasting code into their own browsers, SANS puts AI second only to social engineering among human risks, Layer 8 asks why so few champions programmes get measured, and CISA refreshes its insider threat guide for the hybrid era.

Read briefing →
Signals 7 Sep 2026 6 min

SIGNAL: Week 37 - Who's Asking?

Every story this week turns on one quiet question: who's actually asking? Microsoft has caught attackers posing as IT support in Teams chats; the scam-text factory behind those fake toll and delivery messages rebuilt itself within a month of an FBI takedown; two-thirds of organisations have watched an AI agent go off-script; and student finance payday has scammers circling. One habit beats them all: pause and verify through a channel you chose.

Read briefing →
Signals 31 Aug 2026 8 min

SIGNAL: Week 36 - Humans in the Loop

AI is now the second biggest human risk we manage, says SANS. Researchers watched developers forget to ask their AI for secure code, the NCSC wants a named human minding every AI agent, and a standout SOUPS study found that ignoring a phishing email can feel socially risky. Week 36 is about keeping humans in the loop, and keeping the loop humane.

Read briefing →
Signals 24 Aug 2026 10 min

SIGNAL: Week 35 - The Second Look

A voice that sounds right, a friendly message from a plausible stranger, a programme everyone assumes is working: this week is about what survives a second look. New research finds even IT professionals can no longer hear a voice clone, the phishers went after the phishing experts, and two new studies show what really keeps a champions programme alive. The fix is procedure, not sharper instincts.

Read briefing →
Signals 17 Aug 2026 9 min

Week 34: Knowing Isn't Doing

If there is a thread running through this week's research, it is the stubborn distance between what people know and what they do. A field experiment presented at USENIX Security showed that AI-personalised phishing sails past people who would spot a generic lure.

Read briefing →
Signals 10 Aug 2026 8 min

Week 33: Mind the Gap

This week's edition circles a single question: what happens in the space between knowing and doing? A peer-reviewed study puts fresh numbers on the awareness-behaviour gap, a benchmark of 14 million phishing simulations exposes how rarely people report what they spot, and the corridors of Black Hat were full of talk about social engineering that no longer bothers with the inbox.

Read briefing →
View all signals → Champions view of this brief →

Ready to build behaviour,
culture, and resilience?

Start your free trial. No credit card required. Up and running in minutes.

Start free trial → Talk to us