top of page
  • Jessica Barker

Conversational Security Awareness: Putting Humanity into Your Human Risk Management Program

During the recent SANS Security Awareness: Managing Human Risk Summit 2023, I was privileged to co-present with Perry Carpenter, Author and Chief Evangelist at KnowBe4. Our presentation was focused on putting the humanity into a human risk management program, aka a cyber security awareness, behavior and culture program.

A visual representation of our presentation, which is detailed in the rest of this blog post
Highlights of our speech were beautifully captured by the impeccable Ashton Rodenhiser of Mind’s Eye Creative

What do we do?

Perry Carpenter kickstarted the presentation by posing an intriguing question: "What is our ultimate purpose? Why did "security awareness" become a thing in the first place?" When we do so much more than “security awareness”, do we need to rebrand our work? If we examine what security awareness professionals do at the enterprise level, our work as security professionals involves much more than just delivering awareness content.

Our domain also involves managing human risk, understanding and influencing human behaviour, and transforming security culture. We now use all of these terms – and more – to describe what we do, and yet for most CISOs and security leaders, it is the term “security awareness” which comes first to mind.

Our goals are to win the hearts and minds of our audience and influence positive behaviours toward cybersecurity and security risks to achieve our ultimate mandate, which is to reduce human (and business) risk. To meet these objectives, it is imperative that we build a well-rounded program that is based on building trusted relationships between the security department and the employees, based on the experiences people share in cybersecurity, and leveraging motivating and engaging content to meet the learners where they are.

When our content is the face and voice of our CISO and team, we must always consider the emotional impact of that content, and our training, events, meetings, and interactions.

In this regard, Perry noted that it is essential to avoid two common mistakes that can hinder our efforts:

  1. Using “us versus them” language about the people at the other side of our content and training. If we fail to use empathy and active listening, then we run the risk of creating enemies and alienating ourselves from our colleagues and partners.

  2. Highlighting humans as “the first line of defence” and “the last line of defence” places excess burden and responsibility on the shoulders of our colleagues, which can backfire and ultimately result in a reduced report rate. Perry encouraged us to think of people instead as “a critical line of defence”, with businesses using a variety of tools and processes to create a holistic and layered defence.

Perry talked through the lifecycle of extrinsic and intrinsic motivations over time, highlighting that the effectiveness of extrinsic motivators diminishes over time while intrinsic motivation shows the best long-term effectiveness. Building an approach to cyber security which takes this into account can help tackle a crucial challenge: how to change perceptions of cyber risk.

Perception is truth

That was the perfect pass for my part of the presentation.

Before tackling the challenge of perceptions, it's important to note that our brains operate differently than computers. We're not equipped with impeccable memories and our interpretation of information shapes our decisions.

The curse of knowledge is a cognitive bias that occurs when an individual who communicates with others fails to disregard information that is only available to themselves, assuming everyone shares the same background and understanding. Security professionals are frequently victims of this bias, resulting in poor communication with employees who are not technology focused. To overcome this barrier, it is crucial that we use language that speaks to the hearts and minds of our audience.

However, if we want to build a compelling narrative, we must understand the learners’ perceptions of cyber risk and security. Perceptions are highly influential in cyber security culture. How people perceive themselves, how they see the security team, and whether they perceive security as an important value and priority for the organization are all paramount factors to consider if we want to understand the security culture of an organization.

One of the most important perceptions is whether people think cyber security is important to the leadership in their organization. When executives lead by example, and their actions match their words, they become the influencers for fostering a positive security culture across the enterprise.

The latest ClubCISO report findings reflect this sentiment:

  • Most CISOs feel their security culture is an ongoing priority and has improved. Yet only 21% seem to measure security culture. This raises the question as to what is informing the perception that security culture has improved.

  • Leadership endorsement of security culture is seen as the most important element of fostering a better security culture, followed by a proactive “report it” culture. Perceptions of leadership endorsement of security are more influential than simulated phishing, tailored training, security champions, gamification, or giveaways.

When it comes to behavior change, the perception of ourselves is crucial. Research suggests that the most important factor in security culture is self-efficacy - a person’s belief that they can successfully execute the recommended behaviour to reach the desired outcome.

Self-efficacy is a reliable predictor of cyber-security intention and behaviour, and interventions that seek to improve self-efficacy among people are more likely to yield positive results than those that merely stress the cybersecurity threat. Raising awareness of threats is fundamental, but it will only take your cyber security culture so far. As we cover in our guide to cyber security culture, the true game-changer is empowering people, raising their confidence, and giving them the tools and guidance to practice more secure behaviors.

Of course, a lot of this comes down to professional skills – communication, empathy, and how we help people develop their self-efficacy. The importance of these skills is recognised more than ever in security, but does the industry truly value them as much as so-called ‘hard skills’? Why do we continue to call them "soft skills" when most people acknowledge they are among the hardest of all to practice?

These human/professional skills are also crucial in overcoming the curse of knowledge, which is where I opened and something we are all susceptible to. The illusory superiority cognitive bias, also known as the Lake Wobegon Effect, is closely related to the curse of knowledge. According to social psychology, illusory superiority is a condition where a person overestimates their own qualities and abilities in relation to the same qualities and abilities of other people. A classic example relates to driving: most people rate their driving skills as better than average (which is impossible: the majority of people can’t be better than average at anything...).

In security, this translates into a false sense that we would never get hacked or be susceptible to social engineering. Of course, we are just as susceptible – if not more so – because of that over-confidence.

Photo of a sticker with my quote "the right phish at the wrong time can catch anyone"
The most popular of my stickers at the SANS awareness summit

Speaking at the SANS Security Awareness Summit was a blast. All speakers took the discussion about managing human risk and empowering our colleagues and communities a step further. Individuals and organizations will learn a great deal by watching the on-demand recordings when they are available.

In the meantime, check out our Ultimate Guide to Cyber Security Culture, where you can learn how to understand, measure, and transform your security culture. You can either read it online or register to receive it in your inbox as a resource to keep coming back to.

I have delivered over 80 keynotes about the human side of cyber security in more than 25 countries, to organizations including NATO, World Government Summit and RSA. Find out more and get in touch to book me for your next event.


Jeffrey Glenn
Jeffrey Glenn

I appreciate Henry for making me realise the truth to a certified hacker who knows a lot about what he is doing. I strongly recommend you hire him because he’s the best out there and always delivers. I have referred over 10 people to him and all had positive results. He can help you hack into any devices, social networks including – Facebook, Hangout, iMessages, Twitter accounts, Snap chat , Instagram, Whatsapp, wechat, text messages ,smartphone cloning,tracking emails and also any other social media messenger or sites. It’s advisable to hire a professional hacker.Thank me later. Contact him here., and you can text, call and Whatsapp him on +1(201)4305865, or +1(219)7960574.....


Agnes Lizzy
Agnes Lizzy

Contact him for any type of hacking, he is a professional hacker that specializes in exposing cheating spouses, and every other hacking related issues. he is a cyber guru, he helps catch cheating spouses by hacking their communications like call, Facebook, text, emails, Skype, whats-app and many more. I have used this service before and he did a very good job, he gave me every proof I needed to know that my fiancee was cheating. You can contact him on his email to help you catch your cheating spouse, or for any other hacking related problems, like hacking websites, bank statement, grades and many more. he will definitely help you, he has helped a lot of people, contact him on,…


Janet Lucy
Janet Lucy

I’m excited to write about Henry Hacker, he is a great and brilliant hacker who penetrated my spouse’s phone without a physical installation app. And I was able to access my spouse’s phone, SMS, Whatsapp, Instagram, Facebook, Wechat, Snapchat, Call Logs, Kik, Twitter and all social media. The most amazing thing there is that he restores all phone deleted text messages. And I also have access to everything including the phone gallery without touching the phone.I can see the whole secret of my spouse. Contact him for any hacking service. He is also a genius in repairing Credit Score, increasing school grade, Clear Criminal Record etc. His service is fast. Contact:, and you can text, call him on whatsapp…

bottom of page