Everything we write, in one place. Insights and articles for practitioners, two weekly briefings, five books, and the papers where the ideas are tested properly. The preprints are free to read.
Short research summaries from the CyBehave programme: one finding, what it means, and what to do with it.
Ask an organisation that deployed AI agents and decided how they behave, and you'll usually find a name by working backwards through a repository.…
Read insight →A new joiner learns how an organisation behaves long before they read a policy. They watch who gets challenged at the door. They hear what the team…
Read insight →Picture a finance officer on a Thursday afternoon. An email arrives from a supplier she has dealt with for years, asking her to update their bank…
Read insight →Most organisations treat security behaviour as a plumbing problem. There is a pipe. Training goes in one end; compliant behaviour comes out the…
Read insight →In February we wrote that AI agents had built their own social network and that your threat model wasn't ready. Moltbook was four days old. It looked…
Read insight →What the science of how behaviour spreads says about how many champions a team really needs, and why your best-connected people may be your weakest…
Read insight →Longer guides on building security culture, managing human risk and running Champions programmes.
You know the training landed. Completion is high, the quiz scores are good, and the behaviour is unchanged. That is not a failure of your programme;…
Read article →Almost every champions programme started in a spreadsheet, because until recently there was nothing else. Spreadsheets fail at lifecycle, coverage,…
Read article →A programme that works at twenty champions often stops working at two hundred. The activity is the same, the numbers look better than ever, and the…
Read article →Volunteers bring motivation without reach. Appointment brings reach without motivation. Neither starts from what a champion is for: their position in…
Read article →The hardest part of a champions programme is the first three months, when the idea is agreed and nothing exists yet. The early choices set the shape…
Read article →Most champions programmes never get properly funded. They start as a side project, survive on goodwill, and fade when the sponsor moves on. The…
Read article →Signals is for the people who run security behaviour programmes. Ripples is for the Champions themselves. Both arrive weekly and both give you something to do, not just something to read.
Weekly: what changed in behavioural cybersecurity, and what it means for your programme.
This week is all about costume. Criminals are borrowing the trappings of legitimacy: fake IT support arriving on Teams minutes after flooding your…
Read briefing →People are not the weak link this week; the path is. The new Oh, Behave! report finds people willing but untrained for AI; an EU-wide survey measures…
Read briefing →Who gets the benefit of the doubt in your organisation? This week: 600 CISOs say AI agents are now insiders in all but name, Singapore office workers…
Read briefing →Weekly for Security Champions and programme leads: an activity, a talking point or a piece of evidence to run with.
Scammers are getting very good at looking like the real thing: fake IT helpers who cause a problem then offer to fix it, scam emails that slip past…
Read briefing →Scammers are sneaking fake meeting invites into calendars, and a new trick asks you to copy and paste a “fix” that is really an attack. Also this…
Read briefing →This week is all about trust. A fake boss’s voice nobody wants to question, why our brains believe first and ask later, the AI helpers quietly…
Read briefing →Five books by Andy Wood, written for practitioners. The Rise of the Security Champion is free to read on this site.
SINGULARITYChoosing Humanity's Future in the AI Age
A step outside security and into the wider question of where AI is taking us. It follows the technology from the tools already saving lives to the systems already deceiving people, and asks what choices are still ours to make.
The Rise of the Security ChampionFrom Awareness to Action
A practical guide to finding, recruiting and keeping Security Champions, written from the experience of building networks in organisations of very different sizes. Free to read on this site.
DECEIVEDWhy We Click, Trust, and Get Hacked
Fraud is far older than the internet. This book traces the same tricks from counterfeiters and confidence men through to phishing and deepfakes, and explains why trust, habit, fear and urgency still work on all of us.
Behaviour Change PlaybookFor Cyber Security
The how-to companion to the culture book. It takes the Behaviour Change Wheel and COM-B and walks through using them on real security behaviours, one step at a time, with case studies.
Building a Cyber Security CultureA Strategic Guide to Protecting Your Business
The case that security is a people question before it is a technology one, and how an organisation gets from annual awareness training to a culture where secure behaviour is simply how work is done.
Preprints, a journal article and doctoral research in progress. Design and validation notes for our instruments are published separately in the Lab.
Maps how security influence moves through a champions network, who it reaches and where it stalls. The aim is to give programme leads something better than headcount to judge a network by.
Most champions programmes hit the same wall in their second year: awareness holds and behaviour stays flat. Existing maturity models grade activity and governance. This one grades carrying capacity, how much reinforcement a behaviour can need and still spread, across five gated stages.
Reads 2024 to 2026 multi-agent research through the four-layer, sixteen-factor model of human cyber risk, rates how well each human-to-agent analogy holds, and finds it strongest at the social layer.
Four pre-registered predictions run on populations of four open-weight models across roughly 720,000 logged calls. One held and three did not: the regularities are real, but different models carry a norm by different individual rules.
Proposes a signed, version-controlled repository of organisational norms that agents load and re-check on a schedule, and argues that a missed or stale check is a useful sign an agent has been hijacked or has drifted.
Nudge and boost both assume the designer of the decision is on your side. In security it is often the attacker. Brace is a response a team agrees and rehearses in advance, so there is no decision left to manipulate.
Peer-reviewed, written with Ying He, Leandros A. Maglaras and Helge Janicke. An architectural pattern for managing risk in the industrial control systems underneath critical national infrastructure.
Find out where your Champions programme stands with the free Health Check, or see the research running in HEROES by CyBehave.