Once Upon a Training Session

There’s a well-known exercise from a Stanford business school class. Students each gave a one-minute pitch, then the room was asked what they remembered a few minutes later. Around 5% recalled a specific statistic. About 63% recalled a story.

Same room. Same presenter. Same information, more or less. Twelve times the recall, just from changing the shape it arrived in.

That’s not a quirk of business school students being bored by numbers. It’s how the brain has always worked. Long before anyone stood at a podium with a clicker, tribes didn’t gather round the fire for a lecture on predator behaviour. Nobody presented a slide on regional leopard activity. They told the story of the person who wandered off the path and didn’t come back. That story did the job a hundred bullet points never could… it made the danger real enough to remember.

What Story Actually Does to a Brain

Facts get filed as information: available if you go looking, easy to lose if you don’t. Story gets filed differently. It gets encoded as experience.

Inside a story, you’re not receiving a list of things that happened to someone else. You’re running a simulation. Who’s under pressure, what they decided, what it cost them. The brain doesn’t file that the way it files a compliance policy. It files it the way it files something that happened to you.

There’s neuroscience underneath this that’s worth knowing about. Work led by Uri Hasson at Princeton found that when someone tells a story well, the listener’s brain activity starts to mirror the speaker’s, and the stronger that coupling gets, the better the listener understands and retains what they heard. Not a metaphor about being on the same wavelength. An observable one.

That’s why you can describe the plot of a film you saw a decade ago in more detail than last week’s training module. One arrived as an experience. The other arrived as content.

Why Story Gets Past the Objection

There’s a second thing story does, and for security people it might matter more than memory.

Sit an adult down and tell them directly that they are a risk to the organisation, and watch what happens internally. They start arguing. Not out loud, necessarily. But somewhere behind the eyes: this doesn’t apply to me, I’d never fall for that, our team is careful, I’ve got too much on for this. Every point you make gets met with a rebuttal, perceivable or not. Researchers call this counter-arguing, and it’s the reason well-made arguments so often change nothing.

Narrative transportation is the well-studied antidote. When somebody is absorbed in a story, the internal rebuttals stop. They’re not evaluating a claim about themselves, they’re following what happens to someone else, and the defences that a direct instruction triggers never get switched on. The lesson arrives while nobody’s guarding the door.

Which is a slightly awkward thing to notice about your own awareness programme: the resistance you keep running into isn’t apathy. It’s what happens when you tell people things about themselves instead of showing them something happening to somebody else.

Your Module Has No Plot

Walk through the average piece of security training and ask a simple question: who is the protagonist, and what do they want?

Most of the time there isn’t one. There’s a topic (phishing, passwords, physical security) and a set of facts arranged underneath it. No character under pressure. No decision with a consequence attached. No moment where the outcome was genuinely in doubt. It’s the training equivalent of a leopard fact sheet: technically informative, structurally forgettable.

There are six things that reliably get past the brain’s bouncer, and story is one of the few formats that triggers several of them at once. Novelty, because something is happening. Emotion, because someone is at risk. Meaning, because the stakes are recognisable. All of that in the sixty seconds a bullet point would have spent listing the facts flat.

Why The People Who Know Most Delete The Story

Worth asking why this keeps happening, given nobody sets out to write something forgettable.

The Heath brothers gave it a name: the curse of knowledge. Once you know something thoroughly, the narrative around it feels redundant to you. You’ve internalised why it matters, so the story that would explain why it matters looks like padding. What’s left, to the expert eye, is the useful part: the rule, the checklist, the sequence of steps.

So a security specialist writes the training and strips out everything that isn’t information, in good faith, believing they’re respecting people’s time. And what lands on the learner is the residue… accurate, dense, and stripped of exactly the thing that would have made it stick.

The instinct to cut the story is the instinct of someone who no longer needs it.

What a Story Actually Requires

Bolting an anecdote onto a slide deck doesn’t count. A case study box in the corner of a policy document doesn’t count either. Real narrative needs three things a lot of “engaging” training skips:

• A character who wants something, so the audience has someone to follow
• A decision that could go either way, so the outcome isn’t a foregone conclusion
• A consequence that lands, so the brain has a reason to keep the memory around

Miss any one of those and you’ve got an example, not a story. Examples inform. Stories stick. That’s the argument of Chapter III of May I Have Your Attention, Please? in three lines.

The Same Message, Two Shapes

Take a real control, the sort that appears in every finance policy: verify payment detail changes by calling a known number before processing.

Here’s the usual shape. Fraudsters may impersonate suppliers to request changes to bank details. Always verify change requests using known contact details. Do not rely on contact information provided in the request. Accurate. Complete. Nobody will remember a word of it by Thursday.

Now the other shape. Priya in accounts payable has forty minutes before she leaves for her daughter’s parents’ evening. An email arrives from a supplier she’s dealt with for three years, same signature, same tone, mild apology about the short notice, new bank details attached, invoice due today. She’s got the number for their account manager somewhere. Calling him means staying late. Processing it means leaving on time, and honestly, what are the odds?

Stop there and ask a room what Priya should do. You’ll get an argument, because everyone in that room has been Priya at forty minutes to five. Nobody argues with the policy version, and nobody remembers it either.

Same control. Same information. One of them has a person in it who wants something, a decision that could go either way, and a consequence hanging off the end.

Don’t Resolve It Too Quickly

The temptation with the Priya version is to answer it immediately. Slide two: she should have called. Well done everyone, moving on.

Don’t. Unresolved tension is doing work while it stays unresolved, which is why television has ended episodes on cliffhangers for seventy years and why you can still remember what happened in a drama you watched in your twenties. Let people commit to an answer, argue with each other, sit in the discomfort of not being sure, and only then show them what happened.

The brain holds onto a question it has personally invested in. It discards an answer that arrived before the question landed. Which is also why one-off, front-loaded training struggles against the forgetting curve: information that arrived without tension has nothing anchoring it in place.

“We Haven’t Got the Budget for Storytelling”

The usual objection, and it’s based on a misunderstanding of what’s being asked for.

Narrative isn’t production value. It’s structure. Priya cost nothing… no film crew, no actors, no animation studio, no scriptwriter. It’s three sentences arranged so that a decision sits at the end of them. You can deliver that in an email, in a five-minute team huddle, in a Slack message, on a poster by the kettle.

The expensive-looking security training that lands flat and the free three-sentence story that gets quoted back to you a month later differ by structure, not by budget. One had a character, a decision and a consequence. The other had a brand-compliant template and a voiceover.

Your Own Near Misses Are the Best Material You’ll Ever Get

And they’re sitting unused in your incident log.

Every organisation has them. The invoice that nearly went out. The person who rang to check and turned out to be right. The contractor who got through the door because it was raining and someone was being kind. These are better than any scenario a vendor could write for you, because they happened here, to people whose names your audience recognises, in circumstances everyone recognises too.

The reason they never get used is culture, not content. You can only tell those stories if the person at the centre of them isn’t going to be humiliated by the telling. Which is the whole argument for blame-free reporting arriving from an unexpected direction: a punitive culture doesn’t just slow down your incident response, it also destroys your best library of teaching material before you can use any of it.

Anonymise the person. Keep the pressure they were under. That detail is the part that makes it land.

Same Fire, Different Century

The tribe round the fire had one advantage the modern training room doesn’t: nobody was checking their phone. But the mechanism hasn’t changed. People still learn best from what happened to someone, not from what could theoretically happen in general. If your security training has no narrative, it isn’t a delivery problem you can fix with better slides. It has no chance of being remembered at all.

Stop telling people what could happen. Show them what did.