Articles
Longer guides on building security culture, managing human risk and running Champions programmes.
Showing 13 to 24 of 54.
Security Is Not THE Priority
Security is what the literature calls a secondary task: something you must do on the way to your real goal. A salesperson opens their laptop to close…
Read article →When did awareness become a science nobody told us we had to study?
For two decades, the role was understood. You came from learning and development or communications. You wrote clear copy, built the training, ran the…
Read article →The expertise gap: why security teams must build behavioural capability
There is a quiet contradiction at the heart of most security functions. They exist because people are the most consequential variable in…
Read article →Measuring What Matters
This is Part 4 of a four-part series. Parts 1 to 3 covered dual process theory, cognitive biases mapped to attack vectors, and practical intervention…
Read article →The New Behavioural Attack Surface: Why Shadow AI is Not a Technical Problem
There is a particular kind of conversation happening in organisations right now that nobody quite wants to look at directly. It happens between a…
Read article →Designing Security for Humans
This is Part 3 of a four-part series. Parts 1 and 2 established why people behave insecurely despite knowing better, and mapped the cognitive biases…
Read article →The Biases That Hack Your People
This is Part 2 of a four-part series. Part 1 introduced dual process theory and the knowledge-behaviour gap. This article maps specific cognitive…
Read article →Your Users Are Not the Enemy
This is Part 1 of a four-part series on behavioural science for cybersecurity practitioners. It introduces the foundational theory that explains why…
Read article →The Security Champion Effect: How One Person in the Right Place Can Change the Entire Risk Profile of a Team
Somewhere in your organisation, a team’s cyber risk is elevated, not from unpatched systems, but behaviour: how files are shared, credentials…
Read article →Context-Aware Security Reduces Resistance
There is a familiar paradox at the heart of most enterprise security programmes. The harder organisations push to control human behaviour through…
Read article →AI agents just built their own social network. Your threat model isn't ready.
Moltbook is making headlines. It looks like Reddit, but AI agents are doing the posting, commenting, and upvoting while humans are mostly just…
Read article →The Science of Security Culture Change: How Data-Driven Security Champions Actually Transform Organisations
Research in organisational behaviour consistently demonstrates that strategic positioning of change agents within social networks significantly…
Read article →From reading to doing.
Find out where your Champions programme stands with the free Health Check, or see the research running in HEROES by CyBehave.