What the Brain Actually Responds To

As I’ve said in previously… cyber training is built on the wild belief that if we explain threats clearly enough, spell out the rules enough times, and throw a multiple choice quiz in at the end, behaviour will magically fall into line. And yes, while it sounds sensible and professional… neurologically, it’s just plain wrong.

Our brains don’t prioritise “information”. We prioritise signals. Threats, novelty, emotion. Something that taps you on the shoulder and says HELLO PAY ATTENTION TO ME BECAUSE THIS MATTERS. And let’s face it, most cyber training sends absolutely nothing to the brain that it feels even remotely compelled to respond to. It’s mostly beige noise… corporate lift music for the mind, if you will. A drizzle of policies, bullet points, and diagrams that trigger the same neurological response as reading the back of a shampoo bottle.

We don’t absorb every bit of data we encounter. Thank fuck. Imagine having to remember every mundane and boring snippet of info you consume every day. Advertisers would only have to spend on an ad once and BOOM, they’d be bajillionaires. Every poster, every pop-up, every soul-sucking conversation with Gary in accounts would be whirling round your brain, etched into memory like a bad tattoo.

Thankfully, we have a built in noise filter that sifts through the emails, the messages, the alerts… faces, tabs, meetings, notifications… and other people’s “quick questions”. And most of it is discarded without ceremony. Bye bye. See ya later. Sayonara. Good night.

What survives isn’t what’s the most important on paper. It’s what feels relevant RIGHT NOW.

Signals that cut through tend to be the weird ones, the novel ones, the emotionally charged ones, the socially awkward ones… the pattern interrupts… the signals linked to consequences, or maybe those just uncomfortable enough to demand attention. These cues evolved to keep us alive. They work fast, instinctively, and mostly outside of conscious control. A slide deck, however beautifully structured it may be, does not qualify.

The Attention Problem

Attention is selective. And it’s ruthless. Training doesn’t get it by default. It has to EARN it. The brain allocates attention based on perceived relevance. And perceived threat. If something feels routine, familiar, or safe, it fades into the background… even if it’s objectively quite important.

This is why people can sit through an hour of mandatory cyber training and walk away with very little they can actually use. Their brains made the call early on… “nothing URGENT is happening here”. There’s no novelty. No emotional signal. No sense of consequence. Their attention has wandered off to emails, lunch plans, existential dread… while the training ploughed on regardless.

Memory is where cyber training fails. And it fails quietly.

The Memory Problem

I’m sure we’d all like to believe that memory is a neat little store of information, waiting patiently to be received on demand. In reality, it’s is messy, chaotic, and deeply biased. It clings to feelings and context and experience… which is exactly why you’ll forget boring shit at the shops like washing up liquid, but never the bottle of wine you’re genuinely excited about.

People are brilliant at remembering how something felt… and absolutely hopeless at remembering what was said. It’s why we hear eternal arguments between couples… “it’s not what you said, it’s how you said it”. We remember laughing so hard we snorted, we remember the hot flush rising in our cheeks when we got put on the spot, or the panic we felt making the wrong call in a meeting. But cyber secuirty guidance we’ve skimmed in our jim-jams while we’re watching Netflix? Yeah… good luck with that.

The brain asks one simple question… “Have I seen something like this before?!”. If the answer is YES, then behaviour kicks in automatically… no debate, no checklist… just get off your ass and move. Figuratively. If the answer is NO… then we either umm and ahh over what the hell to do, or we grab a pattern we do know… any pattern… and we run with it. Email wants me to click a link in a high pressure situation? I’ve done that before when my boss needed something doing. IT broski on the phone needs my password for an update? I got told off for not updating my machine before… better do what he says.

See the problem?

Telling people what an attack “looks like” isn’t the same as helping them actually spot one when it’s happening on a Tuesday afternoon, mid-chaos, post lunch slump, three meetings deep and in desperate need of caffeine. Recognition isn’t built through explanation.. it’s built through exposure.

The Luxury of (Most) Cyber Training

When we do training, we’re typically in a calm environment. No one ever sits down to do it when they’re stressed. So the training speaks to the rational side of the brain. It says read this. Understand that. Remember it later. But we don’t have that luxury in the “real world”.

When we’re actually doing the doing of our jobs, we’re faced with actual pressure. Decide quickly. Avoid embarrassment. Don’t look like a dick. Make the discomfort stop. Act now. It uses a whole different bit of our brain. Which is where the disconnect comes in. If we’re training with one bit of the brain, but working with another… the behaviours we learn aren’t going to transfer. The “rules” are stored somewhere that just doesn’t get consulted when pressure shows up on the scene.

So no… people didn’t forget the guidance. If you ask them again in a completely calm situation, they’ll remember it (which is why CBT feels so repetitive and boring). But in the moment? Their brain doesn’t go looking for that info because there’s a detachment between the environment in which they learnt it, and the environment in which they use it.

We need to design training for the brain people actually have at work – not the tidy, rational, policy-loving one we like to pretend exists. This isn’t an argument for ditching information altogether… it’s an argument for using it in the right context… and for dropping the fantasy that information alone is enough.

If you want people to notice subtle manipulation, pause under pressure, recognise risk early, and respond instinctively… your training needs to engage attention, emotion, memory, and recognition. Which means that you need to prioritise experience over explanation… rehearsal over recall… reality over abstraction.

Our behaviours don’t come from what we know. It comes from what our brains recognise when it matters. We’re impulsive people. We don’t behave rationally. Which is why engagement isn’t a “nice to have”. It’s not about jazz hands and dance routines (although I look great in a sequin number) … it’s not about entertainment for entertainment’s sake… it’s about activating the right cognitive pathways at the right moment.

Without attention, nothing gets noticed. Without emotion, nothing sticks. Without experience, nothing transfers. If we continue to let training ignore how the brain ACTUALLY works… awareness will always stay theoretical. And behaviour will stay exactly the same.