Where the research happens

Testing whether behaviour observed by colleagues, gathered in waves across the year, gives a more honest read on security behaviour than self-report or click-rate.

In scope: how many waves a year is enough, how observer bias shows up and what dampens it, and whether a peer-observed score moves in ways that survive scrutiny from a sceptical board.

What makes a champion network hold together rather than quietly decay: tenure effects, coverage, position in the informal structure, and which signals predict a programme running out of energy before the sponsor notices.

Closely tied to SCIM. The practical question is whether decline can be seen early enough to do something about it, rather than explained afterwards.

Most champion programmes recruit whoever volunteers and hope influence follows. SCIM asks whether where a champion sits in the informal network predicts how much they shift the behaviour of the colleagues around them, so that a programme can place champions on evidence rather than on enthusiasm alone.

Systematically assessing how each established human cyber risk concept maps to AI agent behaviour, and classifying the strength of each analogy rather than asserting that the whole thing transfers.

The work is ongoing because the ground keeps moving. Agent capability changes faster than the literature about it, so the classifications are reviewed rather than fixed.

Nudge and boost were borrowed from health and public policy, where whoever designs the choice is broadly on your side. Security is different. The person arranging the choice in front of you is often an attacker, and in our experience the borrowed tools have produced only narrow and inconsistent successes here.

Brace is our proposal for a third class of behavioural intervention, sitting alongside nudge and boost and designed for the case where the choice architect is hostile. The paper introducing it is available as a preprint, and a field trial is planned to gather evidence for a follow-up. Until that evidence exists, Brace is a working position rather than a finding.

Security culture reaches people through repetition, social proof and identity. An AI agent absorbs none of that, but it will read a file and act on it literally, thousands of times a day. The normative repository is a single, version-controlled, cryptographically signed store of an organisation's charter, security, privacy, ethics, safeguard and escalation norms in a form agents can consume. Agents load a signed release when they start work, re-check it on a fixed cadence, and log which release they were operating under.

That schedule doubles as a compromise signal. Because every agent is expected to renew its norms, a missed attestation or a stale hash is evidence that an agent may have been hijacked or has drifted. The preprint is conceptual and reports no empirical results. It closes with four testable propositions and a pilot design, so this is a working position rather than a finding.

Ask a champion programme whether it is working and the answer is usually a list of what it did: champions recruited, sessions run, tasks completed. The people reporting are the people who run it, and composites built from one set of raters correlate whatever the world does. This paper reviews the research on champion programmes, maturity models and readiness, and the measurement problems underneath all three, then describes how Heroes was designed to avoid them.

The design keeps readiness and maturity apart, draws its three headline measures from three separate rater populations (the programme and security team, the champions, and the champions' colleagues), withholds a headline when the evidence behind it is missing rather than scoring the gap as zero, replaces level bands with a reliable-change threshold, and treats the champion network itself as something that matures. It is a design-science paper: an instrument and the reasoning behind it, with no empirical validation yet. The test-retest and cross-tenant studies it calls for are the next step.