The F Word

There’s an “F” word that cyber security still refuses to say out loud. People shift in their chairs when it’s mentioned. Someone coughs. Someone else rushes to reassure the room that we’re still very serious professionals who definitely don’t mess around. Honest, guv.

Relaaaax. The word isn’t “fuck”.

It’s fun. And somehow… that’s worse. If you mention fun in the context of training, it’s treated like a credibility risk. Fun sounds soft… indulgent… a lapse in judgement. Like admitting you don’t take risk seriously. Like you’ve confused security training with a dire team-building exercise involving some kind of balloon animals.

Frivolity.

Somewhere along the way, we’ve decided that if learning doesn’t feel painful, it can’t possibly be effective. That seriousness is a proxy for value. That boredom equals rigour. And I’d quite like to have a word with the people who decided that. Actually… the brain would quite like a word too.

You see the irony here is almost too neat. From a psychological perspective, fun isn’t a distraction from learning. It’s one of the clearest signals the brain has that something deserves attention. The mistake we make in cyber starts with a lazy assumption that we’ve collectively agreed to not to challenge. Seriousness has become a stand-in for importance. If something feels heavy, formal, and joyless… it must matter. If it feels engaging, enjoyable… playful even… then it must be shallow.

But our brains don’t agree with this categorisation, no sir. It doesn’t reward you for being bored and serious. It doesn’t care if the facilitator is sombre or your slides are written in Times New Roman (the most serious of all fonts). Fun isn’t the opposite of seriousness. It’s the presence of engagement. When something draws us in, challenges us, makes us think… the brain sends out a nice big hit of dopamine. Not as a pat on the head for enjoying ourselves, but as a prioritisation signal.

This matters. Pay attention. Remember this. Come back to it. Do this again.

That isn’t frivolity. It’s the brain performing neurological triage and deciding what gets to survive the noise of every day life. And let me tell you this… boredom isn’t the thing surviving. Boredom makes the brain clock out. And that’s where traditional training falls over entirely.

Don’t get me wrong, the content isn’t the issue. The information we’re giving people is spot on. But the delivery method needs work. More than work. In fact, it actively works against how humans learn and remember. Endless slides, videos that drone on, faux-interactive quizzes… sure, we’ve got the completion stats that say we’re successful. But you know Tom is Finance has retained 0% of what he learnt.

Endurance isn’t the same as engagement. Completing a training module without (audible) complaint doesn’t make us successful. All we’ve done is tick a box. And patted ourselves on the back. Aren’t we great?! The brain, though? It never agreed to that deal.

Fluff.

Fun also performs a quieter, more subversive role. It lowers defences. Not so much that people stop caring… but enough that they stop bracing themselves. Let’s be really real… cyber training often feels evaluative, judgemental and surveillance-heavy.

We know you clicked it. We saw who failed. Bloody end users. Mumble. Mumble. Mumble.

The tone isn’t “let’s learn”… it’s “don’t fuck this up again”. When people feel watched, tested, or judged… they don’t engage. They play it safe. They do the minimum required to get through. But when we shift towards curiosity, challenge, and giving people the permission to explore and make mistakes.. something changes. They lean in. They test ideas. They take risks without fear of looking daft.

That’s where psychological safety comes into the mix. Much like engagement… it isn’t a “nice to have”. It’s the condition where people can start to learn. Properly. And no, we’re not here to make light of cyber risk – it’s a serious topic, we know. But we are here to create a space where people will willingly engage with it… honestly, not defensively.

Fortitude.

There’s also a rumour that fun somehow diluted effort.. that if people are enjoying themselves, they’re taking it easy. Which is a fascinating belief given the popularity of the very optional activity of marathon running. Running 26.2 miles is objectively fucking difficult. It hurts. It takes months of training. It’s inconvenient, expensive, a massive time sync.. and let’s face it… borderline irrational behaviour. And yet people sign up in their thousands to do it every year. Because challenge is compelling… aka FUN.

People will concentrate for longer, wrestle with more difficult problems, tolerate ambiguity, and persist when it’s hard if the experience is engaging. We willingly sink hours into video games, puzzles, and challenges that require far more cognitive load than most cyber training ever dares to ask for (seriously, have you tried doing the NYT crossword?!). It doesn’t stop us putting the effort in though. Because fun doesn’t reduce effort. It removes resistance. And without resistance, people will do far harder things than compliance ever gets out of them.

Forgettable.

Memory has its own biases. And let me tell you… slide decks aren’t up there in terms of importance. Our brains don’t store everything equally. We remember what stands out.. what breaks patterns… what feels different to the norm. And newsflash… having fun ticks those boxes.

Enjoyable experiences create a bit of contract. They carry some emotional weight. Some texture. And that’s what makes memories stick. I can remember every escape room I’ve ever done with mates on a weekend. Not a clue what any of the cyber training I did in my last corp role was about though. (I can hazard a guess… but can’t tell you what platform it came on, what the slides said, what the video presenter looked like, what they said…).

Fun doesn’t dilute your memory.. it strengthens it. It gives the brain something worth keeping.

Finish.

I think the real discomfort we have with fun though is very little to do with psychology and very much to do with control. Fun can’t be mandated. Attendance can. We can track completion rates. We can report on “compliance” with some nice little upwards charts and a dashboard. Fun? Yeah that doesn’t play by the same rules. It introduces autonomy and that… messy.

People might react differently. And yes, some people might not like this month’s flavour of fun. That’s totally cool. Not everyone likes everything. It’s exactly why you should have a multi strand, multi channel, multi format security training programme. But for every person who doesn’t like it? There are others who fucking love it. Who engage more deeply than expected. Who ask better questions. Who really get involved. Who lean in.

Yes, it’s unpredictable. And I think that makes organisations nervous. But autonomy is where the engagement lives. And without engagement… behaviour change stays firmly on paper.

Cyber deals in serious outcomes. Breaches, outages, reputational damage, financial impact, real-world harm.. I’m not disputing any of that. But seriousness of consequence does not require solemnity of delivery, dear reader. In fact, insisting on gravity at every turn undermines the behaviours we’re trying to shape. It disengages the systems responsible for attention and pattern recognition and recall.

If the goal is behaviour under pressure, then the path there runs directly through engagement. And engagement, inconveniently for some, often looks like fun. Fun isn’t the objective. Engagement is. But fun is a bloody quick way to get there. It’s not just a gimmick or a decoration wedged in at the end. It’s not the absence of depth or rigour. It’s a signal. A clear, biological message to your brain that says “this matters, stay with it, remember it.”

If cyber teams genuinely want to change behaviour consistently.. then we need to stop treating fun as a threat to credibility and start recognising it for what it is… one of the brain’s most effective learning tools. And it’s hiding in plain sight.