Beyond awareness

From awareness to behaviour change, at scale.

Training tells people what to do. It does not change what they do when nobody is watching. This is for the programme that has done the awareness work, watched the numbers level off, and wants the next thing: behaviour that measurably changes, and the method and evidence behind it.

This is you if

  • Completion is high and click rates stopped moving a while ago
  • You want a method for choosing what to try next, not another campaign
  • You care how a measure is built and want to see the working

Three ways to go deeper.

Start with the frameworks if you want something to use this quarter. Start with the research if you want to check our working first. Start with practice if you would rather see it running.

1Method

The frameworks

The methods we publish so you can run a behavioural security programme on purpose, with or without our platform.

  • Secure Behaviour Management
  • SHIELD
  • Choice architecture
  • The behavioural model and Skills Framework
See the frameworks ↓
2Evidence

The research

Where the frameworks come from, how the instruments are designed and tested, and the work on what happens when AI agents act for us.

  • The Research Lab
  • The Science
  • Behavioural Convergence Theory
  • Research insights
Read the research ↓
3Practice

Put it into practice

Find the stage holding your programme back, then see what HEROES by CyBehave does about it today and what arrives with the advanced modules.

  • The free CyberSHIELD Assessment
  • What Base already does
  • The modules in development
See it working ↓
Why awareness plateaus

People already know. Knowing is not the problem.

Behaviour needs three things at once: the capability to do it, the opportunity to do it where the work happens, and the motivation to bother. Awareness only ever touches the first. When completion is high and click rates have flattened, the programme has run out of things that knowledge can fix, and the next gains come from the other two.

CapabilityCan people actually do the secure thing? Skills, knowledge and the cognitive room to apply them under pressure. This is where training helps, and where most programmes stop.
OpportunityDoes the environment make it the easy, default choice? Social norms in the team, the tools in front of people, the processes they follow, and the absence of unnecessary friction.
MotivationDo people want to, in the moment? Habits, beliefs, identity, and the emotional response to risk. Peer influence changes this where a poster cannot.

That is the COM-B model, the basis of the Behaviour Change Wheel and the diagnostic underneath everything below. If it is new to you, read Secure Behaviour Management 101 first.

1The frameworks

A method you can follow, not a list of things to try.

Read them in this order. Secure Behaviour Management is the discipline, SHIELD is how you run it, choice architecture is one of the strongest tools inside it, and the last two are for reference when you need them.

  1. Secure Behaviour ManagementThe discipline as a whole: managing security behaviour deliberately, with the care you already give to technology and process. Start here for the vocabulary.
    Read the 101 →
  2. The SHIELD FrameworkSix stages for running a behavioural security programme: Specify, Hypothesise, Intervene, Embed, Learn, Diffuse. Built on COM-B and the Behaviour Change Wheel.
    Explore SHIELD →
  3. Choice ArchitectureDesign the moment where a security decision gets made, so the secure option is the easy one. Often the quickest way to move a behaviour that training has not.
    See how it works →
  4. The Behavioural Model for Cyber SecurityAn interactive model that adapts the Behaviour Change Wheel to security behaviour, with separate lenses for people, AI agents and the two together.
    Open the model →
  5. The Skills FrameworkThe 30 competencies, across 7 domains, that the people doing this work need. Useful when you are building a team or writing a job description.
    View the framework →
2The research

Built on published science, not a vendor's opinion.

CyBehave runs an ongoing research programme in behavioural cybersecurity and publishes the frameworks, models and instruments openly, so you can see what we measure, how, and why.

Research Lab

How the instruments are built

Design and validation notes on our instruments and models, including the CyberSHIELD Assessment.

Open the Lab →
The Science

The evidence base

The peer-reviewed psychology, behavioural economics and organisational science that everything here draws on.

Read the science →
Convergence Theory

Human and agentic behaviour

Whether the same behavioural science can be extended to understand, predict and govern how AI agents behave.

Read the theory →
Insights

New thinking as it lands

Research-led pieces on behavioural cybersecurity, newest first. The place to look for what we are working on now.

Browse insights →
3Put it into practice

Diagnose. Intervene through people. Measure the behaviour.

Real behaviour change has the same shape whether you run it from a spreadsheet or a platform. Name the behaviour and find what stops it, change it through trusted peers, then ask the people who see it whether it moved.

Free, about ten minutes

Find your constraint stage

The CyberSHIELD Assessment scores your programme across the six SHIELD stages and names the one holding the rest back. Fifteen questions, and your result appears on screen straight away.

Take the assessment → Worked example

Meet Elena, whose metrics have plateaued

A behavioural security lead who has done everything the vendor catalogue suggests. Follow the four steps she takes from a named behaviour to an intervention that is a test, not a guess.

Read her story →

What Heroes Base already does

Every Heroes subscription starts with Base, and Base runs the whole loop. A programme that buys nothing else can change behaviour and show it.

In Base

Priority behaviours

Pick the behaviours that matter to your organisation from the behaviour catalogue, so the programme has a target, not a theme.

In Base

The guided designer

Eight steps from naming a behaviour to scaling what worked, following SHIELD with the science built in and the jargon left out.

In Base

Interventions through Champions

Tasks, campaigns, comms and recognition, so the people with credibility in each team deliver the change in the flow of work.

In Base

The Behaviour Index

Security behaviour as observed by colleagues, measured every wave. Independent of your training platform and of the Champions themselves.

The advanced modules

Three add-on modules take the loop further. They are in development, and you can plan for them now with published pricing. Risk & Incidents, the fourth module, is available today.

In development

Measure & Evidence

Programme Capability, the composite measure of how well the programme is run, and evidence of change a board will act on.

  • Trend every measure with reliable-change testing
  • Behaviour Index by team and site
  • Scheduled board packs and the full maturity profile
In development

Network Optimisation

Network Strength, the composite measure of the network, and the analysis to strengthen it where it matters.

  • Who bridges teams, who is isolated, who carries a message furthest
  • Recruitment targeting drawn from the gaps
  • Succession and single-link coverage risk
In development

Behavioural Science

The complete method for the practitioner who wants the full toolkit and the workings behind every score.

  • The eight-step SHIELD designer in full, with COM-B diagnosis
  • The framework vocabulary on every screen, switchable on or off
  • How every measure is built: signals, weights, what was withheld and why
Start free trial → Base platform and modules
Still getting the network working?Running Your NetworkAssess the programme you have, fix what is stuck and keep it alive.

Find out where your programme is constrained.

The free CyberSHIELD Assessment scores your programme across the six SHIELD stages and names the stage holding the rest back.

Take the assessment → Talk to us