Posts by Amy Stokes-Waters
Why most tabletop exercises fail
The four habits that turn resilience into a meeting, and what to do instead.
Read MoreOnce Upon a Training Session
Stanford found people remember stories twelve times better than statistics. So why does your security training read like a policy document?
Read MoreThe Argument is Now a Product
There’s a version of this post that reads like a press release. That’s not this one. For the last few years, this company has been making an argument. That the human element in security breaches isn’t a knowledge problem. It’s a format problem. That telling people things, in the format almost everyone uses, doesn’t produce…
Read MoreThe Behaviour Formula
Why security programmes optimise one variable in an equation with three. The Behaviour Formula explains how engagement, awareness and culture combine into instinctive behaviour.
Read MoreYou Want Instinct. You’re Funding Awareness.
The evidence is no longer ambiguous: annual awareness training barely changes behaviour. Here’s why organisations keep funding it anyway.
Read MoreWhat The Brain Actually Responds To
Your training is fighting how memory works. Six things get past the brain’s bouncer, and most security modules use none of them.
Read MoreThe Engagement Paradox
Organisations want behaviour change, then fund the formats least likely to deliver it. That’s the engagement paradox, and why your dashboard lies.
Read MoreThe Human Element Just Went Up
Verizon’s 2026 DBIR puts the human element behind 62% of breaches, up from 60%. Another year of awareness training, and the number went the wrong way. Here’s why.
Read MoreAttackers Engineer Behaviour. Defenders Explain It.
Attackers are not doing something fundamentally different to security awareness teams. They are simply better at it. Both are trying to influence behaviour, interrupt habit, and push people away from their default responses. The difference is that attackers openly social engineer, while defenders insist on explaining social engineering as if behaviour changes through understanding alone.…
Read MoreAwareness Is The Outcome
Awareness is treated like a task to be completed, measured, and filed away. But real awareness doesn’t arrive on a schedule or live inside a dashboard. It shows up later, under pressure, as recognition, hesitation, judgement. And if it’s not there when it matters, the work never really happened. We keep saying “awareness” as if…
Read More