From awareness to behaviour change, at scale.
Training tells people what to do. It does not change what they do when nobody is watching. This is for the programme that has done the awareness work, watched the numbers level off, and wants the next thing: behaviour that measurably changes, and the method and evidence behind it.
This is you if
- Completion is high and click rates stopped moving a while ago
- You want a method for choosing what to try next, not another campaign
- You care how a measure is built and want to see the working
Three ways to go deeper.
Start with the frameworks if you want something to use this quarter. Start with the research if you want to check our working first. Start with practice if you would rather see it running.
The frameworks
The methods we publish so you can run a behavioural security programme on purpose, with or without our platform.
- Secure Behaviour Management
- SHIELD
- Choice architecture
- The behavioural model and Skills Framework
The research
Where the frameworks come from, how the instruments are designed and tested, and the work on what happens when AI agents act for us.
- The Research Lab
- The maturity model and the network models
- The Science and Convergence Theory
- Research insights
Put it into practice
Find the stage holding your programme back, then see what HEROES by CyBehave does about it today and what arrives with the advanced modules.
- The free CyberSHIELD Assessment
- What Base already does
- The modules in development
People already know. Knowing is not the problem.
Behaviour needs three things at once: the capability to do it, the opportunity to do it where the work happens, and the motivation to bother. Awareness only ever touches the first. When completion is high and click rates have flattened, the programme has run out of things that knowledge can fix, and the next gains come from the other two.
That is the COM-B model, the basis of the Behaviour Change Wheel and the diagnostic underneath everything below. If it is new to you, read Secure Behaviour Management 101 first.
There is a second reason, and it is structural.
If you run a Champions network, the plateau has a shape as well as a cause. Awareness spreads on a single exposure, and the network most programmes build in their first two years, a roster and then a community of champions, carries it well. Behaviour spreads only when a person sees several colleagues doing it at once, and that network cannot carry it, however active the champions are. The Security Champions Maturity Model calls the gap between the two a wall: a change of structure, not of effort. Beyond Awareness is the journey over it.
Dotted terms show a short explanation when you point at them, or tap them on a phone.
This journey covers the restructuring (Stage 3), the bridging (Stage 4) and the letting go (Stage 5). If your programme is at Stage 2 and the behaviour line is flat, the model explains why more content will not move it. Read the maturity model →
Rebuild the shape
Champions in pairs or triads inside the teams whose behaviour is the target, chosen by nomination for their position, with the community thinned to a backbone. The first behaviour lines move here. Coverage falls, and you say so.
What the transition requires →Widen the bridges
Pair seeded teams with unseeded ones, place champions on existing cross-team ties, and bridge departments to each other. In the illustrative simulation this is the difference between 73 per cent of the organisation and 95.
The bridging work →Let go
Rotate champions out of tipped teams and see whether the behaviour holds. Recruit from tipped teams rather than by drive. Move the security function to the edge of the network it built.
Persistence and regeneration →A method you can follow, not a list of things to try.
Read them in this order. Secure Behaviour Management is the discipline, SHIELD is how you run it, choice architecture is one of the strongest tools inside it, and the last two are for reference when you need them.
-
Secure Behaviour ManagementThe discipline as a whole: managing security behaviour deliberately, with the care you already give to technology and process. Start here for the vocabulary.Read the 101 →
-
The SHIELD FrameworkSix stages for running a behavioural security programme: Specify, Hypothesise, Intervene, Embed, Learn, Diffuse. Built on COM-B and the Behaviour Change Wheel.Explore SHIELD →
-
Choice ArchitectureDesign the moment where a security decision gets made, so the secure option is the easy one. Often the quickest way to move a behaviour that training has not.See how it works →
-
The Behavioural Model for Cyber SecurityAn interactive model that adapts the Behaviour Change Wheel to security behaviour, with separate lenses for people, AI agents and the two together.Open the model →
-
The Skills FrameworkThe 30 competencies, across 7 domains, that the people doing this work need. Useful when you are building a team or writing a job description.View the framework →
Built on published science, not a vendor's opinion.
CyBehave runs an ongoing research programme in behavioural cybersecurity and publishes the frameworks, models and instruments openly, so you can see what we measure, how, and why.
How the instruments are built
Design and validation notes on our instruments and models, including the CyberSHIELD Assessment.
Open the Lab →What your network can carry
Five stages graded by carrying capacity, non-compensatory gates, and the wall between awareness and behaviour.
Read the model →Which shape spreads behaviour
Five network models for a Champions programme, and why the same sixty champions reach five per cent or everyone.
See the models →The evidence base
The peer-reviewed psychology, behavioural economics and organisational science that everything here draws on.
Read the science →Human and agentic behaviour
Whether the same behavioural science can be extended to understand, predict and govern how AI agents behave.
Read the theory →New thinking as it lands
Research-led pieces on behavioural cybersecurity, newest first. The place to look for what we are working on now.
Browse insights →Diagnose. Intervene through people. Measure the behaviour.
Real behaviour change has the same shape whether you run it from a spreadsheet or a platform. Name the behaviour and find what stops it, change it through trusted peers, then ask the people who see it whether it moved.
Find your constraint stage
The CyberSHIELD Assessment scores your programme across the six SHIELD stages and names the one holding the rest back. Fifteen questions, and your result appears on screen straight away.
Take the assessment → Worked exampleMeet Elena, whose metrics have plateaued
A behavioural security lead who has done everything the vendor catalogue suggests. Follow the four steps she takes from a named behaviour to an intervention that is a test, not a guess.
Read her story →What Heroes Base already does
Every Heroes subscription starts with Base, and Base runs the whole loop. A programme that buys nothing else can change behaviour and show it.
Priority behaviours
Pick the behaviours that matter to your organisation from the behaviour catalogue, so the programme has a target, not a theme.
The guided designer
Eight steps from naming a behaviour to scaling what worked, following SHIELD with the science built in and the jargon left out.
Interventions through Champions
Tasks, campaigns, comms and recognition, so the people with credibility in each team deliver the change in the flow of work.
The Behaviour Index
Security behaviour as observed by colleagues, measured every wave. Independent of your training platform and of the Champions themselves.
The advanced modules
Three add-on modules take the loop further. They are in development, and you can plan for them now with published pricing. Risk & Incidents, the fourth module, is available today.
Measure & Evidence
Programme Capability, the composite measure of how well the programme is run, and evidence of change a board will act on.
- Trend every measure with reliable-change testing
- Behaviour Index by team and site
- Scheduled board packs and the full maturity profile
Network Optimisation
Network Strength, the composite measure of the network, and the analysis to strengthen it where it matters.
- Who bridges teams, who is isolated, who carries a message furthest
- Recruitment targeting drawn from the gaps
- Succession and single-link coverage risk
Behavioural Science
The complete method for the practitioner who wants the full toolkit and the workings behind every score.
- The eight-step SHIELD designer in full, with COM-B diagnosis
- The framework vocabulary on every screen, switchable on or off
- How every measure is built: signals, weights, what was withheld and why
