The Argument is Now a Product

There's a version of this post that reads like a press release. That's not this one.

For the last few years, this company has been making an argument. That the human element in security breaches isn't a knowledge problem. It's a format problem. That telling people things, in the format almost everyone uses, doesn't produce behaviour under pressure. That instinct... the kind that keeps people safe when it matters... can only be built by rehearsal.

The book made the case. The newsletter ran the evidence week by week. And now the suite exists.

The Behaviour Formula suite launches today. SHIFT, the first product in it, is generally available now. The rest arrive as they're ready, not before.

What Human Risk Management Looks Like When You Build It Properly

The architecture is the formula itself: (Engagement → Awareness) × Culture = Instinctive Behaviour.

That's not a metaphor. It's the actual sequence. Engagement creates awareness, not the other way around. Culture determines whether either of them compounds into something that lasts. And instinctive behaviour (the kind that keeps people safe without requiring conscious thought) is the goal. Everything else is a proxy metric.

Most vendors selling human risk management start with a dashboard and work backwards. We started with the behavioural science and built the products the evidence demanded.

If you want the formula taken apart term by term, that's a post of its own.

SHIFT: A Virtual Cyber Escape Room, Running All Year

SHIFT is the first product you can put your hands on today. Four immersive scenario campaigns a year. Story-driven, competitive, scored. Your people investigate real-feeling incidents, make decisions, and see the consequences.

Not a module to complete. A system that keeps instinct sharp in the gaps between the big moments, so the forgetting curve never gets a clean run.

And no, it is not a phishing simulator. Ask us the difference... we enjoy that conversation.

CMD: Crisis Simulation for the People Who Own the Worst Day

CMD is next, this autumn. Live, facilitated crisis rehearsal where AI phone calls land on your leadership team's actual phones, decisions branch in real time, and the pressure is real even though the incident isn't. If your board has never rehearsed a breach, they haven't decided how they'll behave in one. Someone else will decide for them.

CTRL Vish: Because the Phone Is Still Undefended

CTRL Vish is on the roadmap. Voice social engineering keeps climbing the breach data and almost nobody rehearses against it. AI callers, scored responses, and a waitlist that's open now.

Instinct Lab: Measuring Cyber Security Behaviour Change, Not Completions

Instinct Lab is the measurement layer we're building underneath all of it. The thing that will finally answer "is any of this working?" with evidence about behaviour rather than completion rates.

Not who finished. Who changed.

It isn't open yet. But every scored decision in SHIFT is already laying down the data it will read from... so organisations running SHIFT today are building their behavioural baseline before the dashboard exists.

Why It Took This Long

Building something that works the way the evidence says it should is slower than building something that ticks a compliance box. We know, because the compliance-box version would have shipped a year ago.

And while we were building it, something told us we were right: SHIFT sold before we made a single public announcement. No launch, no campaign, no case studies to point at... and organisations bought it anyway, off the strength of the argument alone. The appetite for a different kind of cyber security employee training has been there for years. The format was the only thing missing.

What Comes Next

We're talking to organisations right now about what a programme built on this model looks like for them. Not a pitch. A conversation.

If the argument landed... if the book, the newsletter, or the evidence itself finally tipped the scale... this is the place to start.

Talk to us →