Holly-Jane Grayling builds phishing simulations for a living. She has also clicked one of her own... rushed, mid-task, chasing her own overdue mandatory training, and the email landed at exactly the wrong moment. She tells that story on purpose. If the person whose job is security awareness can be caught, what is "people are the weakest link" actually achieving? In her experience, damage. When people trust the security team they flag things early, sometimes before the response team has even stood up. "People aren't careless," she says. "It's chemical hijacking."

Ask her for a training campaign and she'll ask what's really going on first, because "99.9% of the time it's not a training need. It's a result of what's going on in the system." Fix the process, the tooling and the workload, and the human error tends to go with it. The same instinct runs through her approach to policy. Asked to write twenty pages for a tender, she didn't kid herself anyone would read them ("I've written the thing, and I know we don't read it"), so she cut it to the five things people actually need to do. And the word that switches every brain in the room off? Mandatory.

What works instead is small, human and in the moment: a real near miss on screen, a WhatsApp from an "impersonated" boss, a CEO's voice cloned off YouTube in seconds so people feel the threat rather than hear about it. "I'm not going to read a recipe and recreate it perfectly a week later. I'm looking at it as I cook." Cramming a year of behaviour change into October and going quiet for the other eleven months doesn't build a culture... repetition does. Her closing line is the simplest in the episode, and possibly the point of the series: "Please remember we're all human."