Stop Training. Start Rehearsing.

For about a year now I’ve been making the same argument, in a book, on stages, in this newsletter, to anyone who’d sit still long enough. That most security training doesn’t change behaviour. It changes dashboards. That people don’t rise to the level of their training, they fall to the level of their instinct. And that instinct can only be built one way… by rehearsing it, under pressure, until the right move happens on its own.

It’s one thing to argue that. It’s another to hand someone the thing that does it.

So this week we did. The Behaviour Formula suite launched yesterday, and I want to be precise about what that means, because precision is rather the point. The suite is the architecture… the products arrive inside it as they’re ready, not before. And the first one is ready. SHIFT is generally available now. Not “launching”. Not “coming soon, watch this space”. Available. There are organisations already running it, who bought it before we’d announced a single thing… which tells you everything about whether the appetite for a different approach is real.

Here’s the shape of it, without the fanfare. The whole suite runs on one idea expressed as one formula: (Engagement → Awareness) × Culture = Instinctive Behaviour. Engagement and awareness are the inputs, and weak engagement starves everything downstream of it. Culture sits outside the bracket as the multiplier, the one term that can take the whole thing to zero no matter how much you spent on the rest. That’s not a metaphor we dressed up. It’s the actual argument, in the actual order it has to happen.

And rehearsal is the mechanism underneath all of it. It’s the word doing the work in everything we’ve built, and it’s worth being clear about why. Nobody’s instinct was ever built by being told something. Think about a fire drill… the point was never the information. Everyone already knows where the doors are. The drill exists so that on the day there’s actual smoke, your legs know the route before your brain has caught up. Aviation worked this out decades ago. Surgery worked it out. Elite sport never doubted it for a second. Every field where mistakes cost something real has stopped telling people things and started making them do the thing, repeatedly, under conditions that feel real enough to raise a pulse. Security is the odd one out… the one high-stakes discipline still treating a yearly presentation as preparation.

And the part everyone skips: rehearsal only works if it repeats. A single drill doesn’t build an instinct any more than a single gym session builds a muscle. The rep is the product. Which is why nothing in this suite is an event. It’s all cadence.

SHIFT is the first product you can put your hands on. Four immersive scenario campaigns a year. Story-driven, competitive, scored. Not the annual module that schedules its one encounter twelve months before anyone needs the knowledge… but a system that keeps instinct sharp in the gaps between the big moments, so the forgetting curve never gets a clean run at it. It’s the wedge. The lowest-friction way into a completely different way of doing this.

CMD will come next. The crisis simulation where your leadership actually takes the calls and feels the consequences, before any of it is real. And CTRL+Vish is on the roadmap, because the phone is still one of the most effective ways in and almost nobody rehearses against it. More on both over the coming weeks.

But the piece I care about most isn’t available yet, and I’m not going to pretend otherwise. Instinct Lab is the measurement layer we’re building underneath all of it. Because for twenty years this industry has answered “is your security training working?” with a completion rate, which is a way of answering a question by changing it to an easier one. Instinct Lab exists to answer the real version… what people actually do, in a room, on a call, under pressure, across every product you run, turned into one behavioural picture. Not who finished. Who changed. It isn’t open yet. But every scored decision in SHIFT is already laying down the data it will read from, which means the organisations running SHIFT today are building their behavioural baseline before the dashboard even exists. That’s the right order to do it in, even if it makes for a less tidy announcement.

I know how this reads coming from the person who’s been banging this drum for a year. Of course she built a thing. Of course she thinks it’s the answer. So don’t take the argument on my say-so. Take it on the 96% who clicked the thing they knew was risky. On the human element that went UP to 62% after a year of everyone’s diligent awareness training. On the most rigorous study ever done finding annual training moves the needle by 1.7%, which is another way of saying it doesn’t move it at all. The evidence has been pointing one direction for years. We just built the thing it was pointing at.

The book made the case. This is the case, made real. If you’ve been reading along and nodding and wondering what on earth you’re actually supposed to do about any of it… this is the answer. SHIFT is where it starts, and it’s available now.