Engagement is Engineered

On how engagement needs mechanics, not magic

Some people are annoying. No, not in that way. In the way that they’re just… naturally charismatic, funny, interesting. (If you’re all thinking about me right now… well.. what can I say).

We all know at least one of these annoying jerks… maybe it’s your mate down the pub who has the table hanging on his every word. That woman at work who could read out a parking ticket and you’d be asking to hear how it ends. Those people who can take a bloody boring bit of info and turn it into something you actually remember.

And then there’s the rest of us. Apparently doomed to be “not engaging enough”.

But, let’s take a step back… ARE we all doomed? Is engagement just something you’re born with? A lucky roll of the personality dice? Do some people just “have it” while the rest of us are destined to wave our arms and shout a bit louder and hope for the best that someone’s listening?

Or is that the myth? Can ANYONE be engaging? Can anyTHING be engaging? And if the answer is yes (spoiler alert.. it is)… then why do we act like cyber training is the exception to the rule?

The Audience is Always Right

We’ve collectively convinced ourselves that having an important topic should be “enough”. Enough to make people sit up and listen. That if we throw some cold hard stats at them and wax lyrical about the risk (ohhhh THE RISK!!!!), then attention will politely show up, take a seat, and behave itself.

Now I’m gonna tell YOU to behave yourselves. We’ve got to stop putting the onus on the people. The “them” in our weird little them vs us dichotomy we seem to live in in cyber. “They” don’t care about cyber. “They” are too busy to listen. “They” just don’t get it. Yeah cool, we can tell ourselves that. It’s a SUPER neat little rumour for us to spread around. Also conveniently gets us off the hook. Considering it a “them” thing puts the responsibility directly onto “them” and doesn’t that just make all of our lives easier?

If you went to watch a stand up comedian and none of the audience was laughing, you wouldn’t think the audience was the problem. You’d think the comedian was a bit wank.

Well, no. It doesn’t actually. Cause we kid ourselves that it’s a “them” problem, but it really boils down to an us thing. Because when the shit inevitably hits the fan, it’s us who has to deal with it. So how about we make some changes? How about we stop considering engagement as a people problem? And maybe, just maybe, how about we start considering it a design problem?

Look at it this way… if you went to watch a stand up comedian and none of the audience was laughing, you wouldn’t think the audience was the problem. You’d think the comedian was a bit wank. If you watched a documentary and learnt nothing, You wouldn’t think you were thick… you’d think the documentary was crap. And you’d be right. The audience always is.

And it’s the SAME CONCEPT for our training. If our audience aren’t engaged that’s an US problem. Not a THEM problem. We have got to realise that learning requires engagement… and engagement isn’t a personality trait, or a mood that strikes on a good day. It’s not a thing that we either have or don’t have. Yes, some people do just kinda get it. But, the key thing is, it’s entirely possible to engineer. By design.

And what do all like to think of ourselves as in cyber? Engineers!

Social Engineering by Any Other Name

Ok, so we’ve used the word engineer. And often that conjures images of men in hard hats, architecture diagrams, building things. And in a way, that’s what we’re doing but with cyber behaviours. And what do all good building projects need?

A foundation. Well done! And what is that foundation? Well for learning, it’s attention. Why don’t we deliberately construct our training to demand attention? The alternative, as I see it, is that we politely request attention and hope for the best. And that ain’t doing the job as far as I can tell. So this has to be worth a shot, right?

Let’s look at other places where it works beautifully. Well, the first place to start is the with the masters of behavioural engineering (because God forbid we say social engineering)… the MARKETING team. Yes, I’m going back there again. Marketing campaigns are entirely crafted to demand your attention… words selected carefully, colours tested and re-tested, line spacing tweaked, copy pored over… all to capture attention, teach you something, gain your trust, and (eventually) get you to part with your cash.

If engagement were accidental, entire industries wouldn’t exist. Marketing wouldn’t work. Films wouldn’t work. Theatre wouldn’t work. Novels wouldn’t work. We wouldn’t sit in rooms full of strangers, being emotionally manipulated by lights and sounds and words and carefully timed reveal moments if there wasn’t something ENGAGING a) about what we’re watching and b) about what got us into that room in the first place.

And we might look at media and marketing as artistic and creative endeavours. But having worked in marketing for years, I can tell you very much that it relies entirely on the science of behaviour. (Irrational though it may often be). It relies on understanding human attention, emotion, memory, decision making. Nothing about engagement in this context is left to chance. Everything is meticulously engineered to get the right reaction.

Ok, I know not everyone likes the same films. The same books. The same plays. The same products. And if you use actually engaging methods in your cyber awareness training… it’s totally possible that not everyone will like those either. (We’ll talk another time about multi channel approaches). But you’ll get SOME of the people, maybe even most of the people, absolutely hooked. And isn’t that better than having ALL of them bored to death?!

You’ll get SOME of the people, maybe even most of the people, absolutely hooked. And isn’t that better than having ALL of them bored to death?!

The Necessary Ingredients

Our escape rooms, games, and puzzles are engineered in exactly the same way as a good marketing campaign. When we build a scenario, we have to remember that we can’t rely on people to take the very optional path of caring about what we do. Instead, we engineer the conditions to where caring is the path of least resistance. We design focus, and curiosity. We design twists and turns. We design “aha!” moments. We make consequences visible. We earn attention through structure. We don’t beg for it with importance.

The human brain engages when it has something to do. Passive consumption rarely cuts it. Listening, reading, watching… all of these things can happen with one eye open and our minds somewhere else entirely. (I regularly have to rewind my audio book because my mind has wandered elsewhere).

The brain is really good at appearing compliant while disengaging internally. Real engagement (not attendance… ENGAGEMENT) requires participation. The moment someone has to make a decision, solve a problem, choose between imperfect options, or deal with the consequences of their actions… that’s when attention sharpens. That’s when we move from observer to participant.. not because we suddenly care more but because the environment demands it of us.

It’s important that those actions DO have consequences too. When we say we create high-stakes environments, it doesn’t mean we’re talking actual real life catastrophe. We’re not in the game of scaring people. But we do make consequences matter. Yes, they can be fictional… but with the right narrative in place, our brains can connect the dots and let us FEEL the pressure.

So a ticking clock, a decision that closes off other paths, an emotional consequence (plug the USB into the device, we dare you!!)… they’re small pressures. Nothing bad will really happen in real life. But they carry weight with the brain. They send the signal that what you’re doing isn’t theoretical… the choice you’re making counts. Without stakes in the mix, everything feels optional. And optional things are remarkably easy to ignore, no matter how worthy they might seem on paper.

Feedback is also integral… and its absence is one of the fastest ways to kill engagement. Do the thing. Wait. Hope you did it right. Silence. That’s why phishing campaigns don’t bloody work. When people do the right thing, they get nothing. No pat on the back. No well done. Nada.

When effort disappears into the void, we quickly decide there’s no point leaning into that thing any further. Engagement thrives on response. Progress indicators… immediate consequences… that beautiful click of a padlock when you’ve got the right combination… all of these tell the brain that actions matter. Feedback turns effort into learning. Without it, participation feels hollow… which only serves to drain motivation.

I’ve also seen the belief that friction is the enemy. We need to make learning smooth and easy and streamlined… effortless. But ease isn’t the same as engagement. A small amount of friction tells the brain something’s worth paying attention to. Making someone think, choose, struggle a bit… that signals value. If we remove it, the experience just floats past us. The right amount of friction locks attention in. Engagement lives in getting the balance right.

And autonomy is the other key ingredient. People engage more when they feel a sense of agency.. when they’re in control of the pace, when they can influence the outcome, when they can make real choices that matter within the system itself. It’s not about anarchy, chaos, or lack of structure… it’s about giving people ownership. That’s what switches learning from passive to active.

As I’ve said repeatedly, the problem with engagement is that we treat it as a by-product… something that might happen if the stars align. If we leave it to chance, then yeah it’s super fragile. But when it’s designed deliberately and thoughtfully… it’s RELIABLE. That’s the shift we need to make in cyber. We should stop asking how to get people to care… as if we can magically summon the workforces’s cognition with the right slide or slogan… and start asking what kind of environment we’re creating. And whether that environment is designed to make engagement inevitable.

Because engagement isn’t about motivation. It’s about mechanics. And when the mechanics are right, behaviour follows.