Building a Champions Network That Works, part 7 of 7
If you run a security awareness programme, you have almost certainly had the conversation where someone senior asks why people still click, still share passwords, still approve the invoice, after all the training. You know the training landed. Completion is high, the quiz scores are good, people can tell you what phishing is. And yet the behaviour is unchanged. That gap is not a failure of your programme. It is the predictable result of a model of behaviour that the awareness industry inherited, and that behavioural science abandoned some time ago.
This article is for people who already run good awareness programmes and want to understand why knowledge so rarely converts into behaviour, and what to do about it. Many awareness professionals have already made this shift and are doing some of the most interesting work in security. Others have been left to find their own way with little support from employers who still measure them on completion rates. What follows is the map.
The assumption underneath most awareness work
Traditional awareness rests on a single implicit theory: if people knew better, they would do better. Give them the information, test that they received it, and behaviour will follow. It is a reasonable assumption, and it is wrong for most of the behaviours we care about. Bada, Sasse and Nurse reviewed awareness campaigns a decade ago and found the same pattern repeatedly: knowledge improved, behaviour did not, because the campaigns addressed only one of several things that determine what a person does.
Psychology explains this well. Daniel Kahneman's account of two systems of thought explains it best. The deliberate, reasoning mode that awareness training addresses is slow, effortful and switched off most of the working day. The fast, automatic mode that actually handles the inbox at four in the afternoon runs on habit, cues and the path of least resistance. Training speaks to the first system. Behaviour comes from the second. You can teach someone to recognise a phishing email in a classroom, and they will still click one on a busy Friday, because the classroom knowledge was never loaded into the mode that was doing the clicking.
A better model: capability, opportunity, motivation
The most useful framework for awareness professionals making this shift is the COM-B model developed by Susan Michie and colleagues at University College London. It holds that any behaviour requires three things at once: the capability to do it, the opportunity to do it, and the motivation to do it. Remove any one and the behaviour does not happen, however strong the other two.
Awareness has long focused on capability, mostly the psychological kind: knowing what to do. It has largely ignored opportunity, which covers whether the environment makes the behaviour possible and easy, and whether the people around you are doing it. And it has treated motivation as something you can create with a slide about consequences, when most motivation is automatic, emotional, and social rather than reasoned.
Run any stubborn security behaviour through the model and the diagnosis is usually obvious. People do not report suspicious emails because the reporting button is three clicks away and nobody ever hears back, an opportunity problem. People share credentials because the approved process takes two days and the project is due tomorrow, again, an opportunity problem. People do not challenge a payment request from someone senior because challenging feels socially costly, a motivation problem that no amount of information will touch. In each case, the awareness team has been asked to solve a problem that awareness cannot reach.
Diagnose before you intervene
The biggest change in practice that follows is to stop designing interventions before diagnosing the behaviour. Pick one behaviour, not "be more secure" but something specific and observable: report suspicious messages within an hour, verify payment changes by phone, lock the screen when leaving the desk. Then ask, with real people and not from a conference room, what stops it. Is it that they cannot, that the environment does not let them, or that they do not want to? The answer is often surprising and almost always different from what the security team assumed.
Michie's Behaviour Change Wheel then maps each diagnosis to the kinds of intervention that work for it. Capability problems respond to training and enablement. Opportunity problems respond to environmental redesign, which usually means working with IT and process owners rather than producing content. Motivation problems respond to modelling, incentives, persuasion and social norms. Awareness professionals who make this shift find that a growing share of their work is no longer content production. It is negotiation with the people who own the environment.
Social norms do more work than messages
Of the levers available, the one with the most evidence behind it and the least use in security is the descriptive norm: what people believe others like them actually do. Robert Cialdini's field experiments showed repeatedly that telling people what their neighbours do changes behaviour more reliably than telling them what they should do, and that the effect works in both directions. A campaign that says "most people still fall for phishing" is, unintentionally, a message that clicking is normal.
Security behaviour is social. People check when they see colleagues checking and stop when they see colleagues not bothering. This is why the most effective interventions in our experience are the ones that make careful behaviour visible in teams, through champions, through managers who model it, through reporting numbers shared at team level rather than company level. An awareness professional who understands norms stops asking how to reach everyone and starts asking who in each team others are watching.
Make the secure path the easy path
The other lever awareness rarely pulls is choice architecture, the deliberate design of the environment so that the desired behaviour is the default. Thaler and Sunstein's work on nudging is well known outside security and, oddly, rarely applied inside it. Defaults, friction and timing matter enormously. A report button in the ribbon beats one in a menu. A verification prompt that appears at the moment of a payment change beats a policy that describes it. Multi-factor prompts that arrive when the person is already expecting them beat ones that arrive at random.
Most of these changes are not in the awareness team's gift, and that is the point. The behavioural professional's role expands to include influencing the people who design systems and processes, arguing for security behaviour to be built into the path rather than bolted on as a request. That is a different skill from producing training, and organisations should help their awareness teams develop it rather than expecting them to acquire it alone.
Measure behaviour, not exposure
Finally, change what you count. Completion rates, open rates and quiz scores measure exposure to a message. They say nothing about behaviour. The measures that matter are behavioural: reporting rates and reporting speed, the proportion of payment changes verified, the number of credentials shared through unapproved channels, the time between a phishing email arriving and the first report. Many of these can be drawn from systems that already exist. Once the programme reports on these, the conversation with leadership changes, because the awareness team is no longer describing what it sent but what people did.
The shift, in one sentence
The move from awareness to behavioural change is the move from asking "what do people need to know?" to asking "what stops people doing this, and what would make it easy and normal?" It is a bigger job, spanning environment, process and social dynamics as well as content, and it needs support from employers who have been measuring the wrong thing. But it is also the job that produces results, and the awareness professionals who have made the shift are now being asked to lead security culture rather than service it.
About this series. Building a Champions Network That Works is a seven-part guide from CyBehave to starting, funding, recruiting, scaling and measuring a security champions programme, and to the shift from awareness to behaviour change that sits underneath all of it. Previous: Part 6, Moving on from the spreadsheet.