The Rule of Seventy.

When Nobody’s Watching episode five went out last Wednesday, and for the second episode running the guest has never worked a day in cyber security.

Owen Sutton spent 21 years at BT and finished as head of brand management and design. For two decades his job was getting the attention of people who were busy, tired and not interested… and then getting them to do something. He now runs Quietwork. I handed him our industry’s awareness campaign as a brief, and he started where every marketer starts.

“Make sure that subject line is bloody interesting and gives you a reason to open it. That’s the first thing, right? People need to know you exist. If they’re gonna scroll past the email, everything else is a waste of effort.”

And I mean, think about what that does to the average awareness programme. Everything you spent the budget on sits behind one email, and if the subject line doesn’t get opened, none of it happened. Owen wasn’t being harsh about it either. That’s just how he sees a funnel.

And then he gave me the number.

“There’s the age-old rule that you gotta get something in front of people 7 times. Well, I think nowadays it’s probably 70 times.”

Seventy. Now put the annual module next to that. Once a year, 30 minutes, a certificate, done. Even the old rule of seven made that look thin, and Owen has just multiplied it by ten. Marketing has been paying for repetition for a century because it’s the only thing that has ever actually worked.

The email itself? He’d seen plenty.

“It’s often you got essentially kind of techy people talking to techy people, and they think they talk the same language. And yet you’re trying to impact the behaviours of people who are not in that space at all.” So what happens is “most IT departments will send an email with a load of techy speak and far too many bullet points, and we ain’t gonna read it.”

So I put the thing to him that I actually believe. One campaign a quarter. One behaviour. Instead of all eight messages at once and nobody remembering any of them three weeks later. He agreed, and he explained it with the bins.

“My wife gives me too many things to do. None of them get done. If she says, ‘Look, I just need you to take the bins out,’ I’ll get up and I’ll go take the bins out.” Add three more asks and “it’s like I’m overwhelmed. It’s gonna fail massively.”

And that’s your workforce. Every time you send them the full list, you get none of it. “Pick a target, stay focused, achieve that goal.”

He also had one that costs absolutely nothing.

“Say, ‘Oh, the finance team are beating you by 5%.’ Hit this button to see if you can beat them. Suddenly it’s, like, fun, right?” Because, as he put it, “Facts are boring. And we don’t care.” And of course we all want to beat finance. Nobody has ever wanted to read the fact sheet.

Then there’s the bit for anybody whose answer to risk is a ban. BT blocked WeTransfer. Owen, head of design, had a massive file and a printer waiting for it. “How can I get this massive file now to my printer? I’ll be sending it to myself, or it’ll be going on my personal laptop.” And then: “People will find a way around it. So you’ve got to watch out for people like me.”

So the risk didn’t go anywhere. It went onto a personal laptop, and nobody in security ever heard about it.

So what do you actually do with all of this? You go and talk to marketing.

Every tool the awareness function wishes it had already exists in your building. Somebody in marketing knows what a subject line is for, has a budget for repetition, and tests things before sending them. I said as much on air: maybe the security team should go and have a chat with the marketing team and steal some of their tools.

Owen’s version was simpler. “Don’t work in silos. Cybersecurity guys, don’t work in silos. Have conversations with marketing.”

And if you want the reason it matters, he gave that too, having come in expecting to be bored. “I can’t remember all the different electronic trainings I’ve had to do over the years. They’re boring as hell. But I remember all your props. They stick in your mind. And they’re visceral, and they make you feel something.”

So book half an hour with your marketing team this week. Take them the subject line of your last security email and ask them if they’d have opened it.

Owen’s episode is live now, and the rest of it is just as good: why a brand for the security team is probably an overreach, why fear works for about a month and then stops, and what he did to the worst awareness poster we could manufacture in Fix It in 60. Watch it here.