Issue009 3 March 2026

More Slides Won’t Save You

Amy Stokes-Waters 6 Minute Read

On why knowing better doesn’t stop breaches.

Ask someone what they would do in a hypothetical situation and they’ll give you a perfectly rational answer. Calm. Considered. Sensible, even. It’s a bit like asking someone how they’d react if a car suddenly swerved towards them. Of course they’d stay calm. Of course they’d make the right call. Then put them in the driver’s seat. Add rain on the windscreen, a kids arguing in the back, a phone pinging on the dashboard, and in that split second… instinct takes over.

Suddenly the tidy, logical answer feels very far away. Add some time pressure, social awkwardness, status dynamics and a dash of uncertainty in the workplace, and watch that neat intention quietly evaporate.

It isn’t dishonesty. The intention is absolutely there. Most people genuinely want to do the right thing. It’s the context that changes. We ask people what they would do. We teach them what they should do. We give them a little quiz to prove they understand the rules. It’s a bit like reading a recipe, answering a few questions about it, and assuming that means you can now handle a busy kitchen on a Saturday night. Then the tickets start flying in, something’s burning, someone’s asking where the salt is, and the whole thing feels different. Under pressure, the tidy theory collapses and people do something else entirely.

This isn’t a failure of memory. It is a failure of transfer.

Behaviour doesn’t glide neatly from one context to another. Learning is deeply tied to the conditions under which it happens, and behaviour even more so. When knowledge is acquired calmly… abstractly… without consequence and without emotion, it becomes attached to that safe environment. It works in the classroom. It works in the LMS. It works in the post-session chat where everyone has 20/20 hindsight and no real risk. Think of it like practicing fire drills in an empty car park on a sunny afternoon. When the context shifts and pressure rises, ambiguity creeps in, Slack is pinging, a senior leader is waiting for an answer, and there is a real chance of embarrassment or fallout, the brain no longer recognises the situation as the same problem. To the nervous system, this is not a drill. It does not retrieve the same response because it does not feel like the same moment at all.

Article content

This is where a lot of training falls apart. Knowing what to do is not the same as recognising when to do it. People can describe phishing red flags, explain password hygiene, or outline the escalation process perfectly. They can talk about it the way someone can describe how to ride a bike. But recognition is a different task entirely. You only really learn to balance when you wobble. Recognition relies on familiarity, and familiarity is built through experience… not explanation. If the learning environment never resembles the conditions of real work, the brain has no reason to flag the moment as relevant. The information exists, but it sits there like that gym membership in January. Technically useful. Rarely activated when it really counts.

In an effort to make training safe, tidy and non-threatening, organisations often strip out the very ingredients that drive behaviour in real incidents. Pressure is softened. Uncertainty disappears. Time constraints are removed. Emotional stakes are flattened. Ironically, these are exactly the triggers that shape real decisions. It’s a bit like teaching someone to swim by letting them lie on the floor and practise arm movements. Then one day they’re in open water, it’s cold, they can’t touch the bottom, and suddenly the theory feels flimsy. People are trained in a world where nothing is urgent, nothing is awkward and nothing has consequence, then expected to perform flawlessly in a world where all three arrive at once. The gap that follows is not ignorance.. it’s misalignment.

That misalignment explains why post-incident responses feel so repetitive. Something goes wrong and the instinctive reaction is more training. More reminders. More slides explaining what should have happened. It’s like replaying the same driving theory video after a crash and hoping that this time it sticks. But if the original learning never transferred, repeating it in the same format does not fix the issue. Without changing the conditions under which learning takes place, the outcome remains stubbornly familiar. Behaviour does not change because people heard the message again. It changes because the brain has learned to see the situation differently.

For behaviour to transfer, it must be rehearsed, not simply reinforced. If people are expected to act under pressure, they need the chance to practice under pressure. Not chaos for the sake of it, but realistic decision points where information is incomplete, priorities compete, social dynamics intrude and action is required before certainty arrives. This is how pilots train. This is how emergency responders train. They rehearse in environments that feel close enough to reality that the brain begins to build recognition. “I have seen this before. I know this pattern. I know what to do next.” That sense of familiarity is what carries behaviour across contexts when it really matters.

Feedback completes the loop. Experience alone is not enough. People need to see what happened as a result of their choices, where things derailed, and how a different decision would have changed the outcome. Think of learning to cook again… you only improve when you taste the sauce and realise it needs salt. Without feedback, experience is just noise. With feedback, it becomes refinement. This is how behaviour evolves in practice, not through instruction alone, but through informed adjustment over time.

Over time, these rehearsals shape culture. What an organisation repeatedly practices is what it becomes good at. If people rehearse speed without verification, compliance without thinking, and resolution without challenge, those behaviours will surface when pressure hits. If they rehearse pausing, questioning, escalating and collaborating when things feel uncomfortable, those behaviours will transfer instead. Culture is not what lives on posters or in values decks. It is what feels familiar when the stakes rise.

Fixing transfer is not about louder messaging or more frequent reminders. It is about redesign. Learning experiences must resemble the environments people actually operate in. They must activate the same cognitive and emotional systems that show up during real incidents. They must allow behaviour to be rehearsed rather than merely described. When learning feels recognisably close to reality, behaviour carries over naturally. Not because people tried harder to remember, but because, when the moment arrived, it no longer felt like the first time.

That's it for this week. Reply and tell me what you think.

Amy

Amy Stokes-Waters · Founder, The Cyber Escape Room Co.