Listen:
The Write Up
The exchanges worth stealing.
Do people behave differently when nobody's watching? Of course they do, and so do all of us. Watched, people toe the party line; unwatched, they do whatever they want, and if you doubt it, ask why shadow IT exists. Policing taught her the rest. People revert to habit when the pressure lands, whatever they've read or been told or signed. You need the policy. Nobody reaches for it. "Nobody reverts back to that when the world's on fire." And when it goes wrong they hide it, then they deny it, then they blame the person who caught them. Security is no different.
The number that mattered when she arrived at Blue Light Card was how many colleagues clicked a simulated phishing link, which told her nothing. So she changed it. The stat that goes to the exec team now is how many people report. Every guest this series said click rates were the wrong measure. This is the one who swapped them. It follows that she won't discipline anyone for clicking, and she's heard of organisations that do. "How can you discipline somebody for making a mistake? Ultimately, their job isn't security. Their job is their job." Report something that turns out to be harmless and you get an explanation, not a telling off, and next time you get it right.
She wanted a brand for security and ran a campaign asking colleagues to write the slogan. Someone in legal won: not sure, be sure, report it. The model was British Transport Police, and the point is who wrote it, because it came from inside the business and someone other than the security team gets the credit. She gets out from behind the desk too, which is how a colleague's elderly neighbour ended up on the phone to her after a scam. And after an incident, don't hand people the sanitised summary. Tell them exactly how bad it was and who had to deal with it, because when Amy was only told that ransomware meant a day off, her honest reaction as a broadband seller was to start clicking everything.