Before Frameworks, There Were Fairytales
On why narrative beats instruction.
It's mid-afternoon. You're already behind. Teams is steadily pinging, your inbox is stacked, and you're halfway through a task you don't really want to be doing when another message lands. You don't open it straight away. You skim the preview.
Fuck. It's from the Head of Finance.
Your stomach does that tiny, stupid drop it always does. Not panic. Just irritation. The kind that arrives with every email from management. It starts before you've even read the words.
What the hell does he want now?!
You replay the morning in your head. You didn't miss a meeting. You sent over those numbers you were supposed to. You haven't done anything obviously wrong. Still, your shoulders tense anyway. You open the message.
It's shorter than you expect. No greeting. No fluff. He must be really pissed off. Or in a rush. Maybe I did do something wrong in that call...Just a question, followed by a sentence that reads like it was typed one-handed between meetings. There's a deadline implied, but not stated. Just hovering there. The unspoken "I need this quickly".
You glance at the clock, feeling that familiar squeeze. Usually you're watching the clock but now? It's watching you. You can feel it.
Your instincts start to kick in. Defensiveness first, as usual. This isn't my problem.
Then explanation. If I don't do it, I can justify it... if he'll just listen to me for thirty seconds.
And finally... the one that usually wins... compliance. I'd better just deal with it. I don't want to piss him off more.
You play the back-and-forth in your head if you don't get it done. If you don't respond quickly. The following-up message that will come. The slight edge creeping into his tone. The judgement that you're being difficult, again. Or worse, slow... or unhelpful.
You're just so tired. Everyone's tired here. You tell yourself this is just how work is now. Constant switching between tasks. Everything feels urgent. Everything's important. Everyone's stretched. It's only until this project is out of the way and it'll all go back to normal.
You notice your jaw is clenched.
Breathe. You scroll back up and reread the message, slower this time. It still looks... fine. Annoying, maybe. Inconvenient, of course. But normal. Boring, even. The kind of thing you deal with without thinking most days.
You could ask for clarification. You picture yourself doing that. The pause. The delay. The effort of wording it so it doesn't sound arsey. The chance it turns into a whole.. "thing".
You don't want a "thing". You just want it off your plate. Your cursor blinks in the reply box, patient and insistent. You think about how good it will feel to tick this off. To be done. To move on. To feel, briefly, like you're keeping up.
You start typing.
And back to earth, dear reader.
We're not here to read stories, we're doing far more serious work than that. We're teaching people about cyber security for heaven's sakes. And we can't be doing that with salacious little narratives that are interesting, and intriguing, and actually hold people's attention now, can we?
Or can we?
Because long before policies, procedures, or formal education ever existed, humans taught risk through story. Before there were rules, there were fables. Before there were frameworks, there were fairytales. Before compliance, there were warnings disguised as entertainment.
Aesop didn't write stories about foxes and crows because it was cute. Fairy tales weren't invented to soothe children. They were built to teach consequences. Don't trust flattery. Don't wander off alone. Don't take shortcuts when something feels off. Curiosity has a cost.
The stories weren't subtle. They were memorable on purpose. In early versions of Red Riding Hood, the wolf eats her. She dies. It's a lesson about not trusting random men in the woods.
There's no explanation of risk, though. The story just shows it happening. It's not a piece of art to be digested for your entertainment. It's survival infrastructure. But despite there being proof across millennia of it working to convey messaging, we've decided in the 21st century that story telling is not professional enough for us. Sorry, good old tried and tested method... you're outta here.
So we pile on the information instead. Read this framework. Look at this risk diagram. Watch this instructional video. Oh, and would you look at that? Everyone's behaviour stays exactly the same. It's almost like you didn't engage them enough to get any messaging to land. Weird that. We keep treating engagement like a bit of parsley on the side of your plate.. nice if you have time to make it fancy but completely dispensable if you don't.
And when people don't change off the back of this "revolutionary" method of training? Well, we just pile a bit more on! Have some more content, dear workers. Please do some extra video modules. Look at this fact sheet. Let us explain security headers to you again.
Fucking stop it.
When something goes wrong, people don't act on information. They're not even thinking about the information. They're thinking "oh shit, the FD messaged me and I better get that job done or he's gonna think I'm a dick". So, unless we've given people the experience of receiving a dodgy email from a person shaped like the FD, showed them the consequences of complying with said email, and let them build emotion and memory around it... they're not even connecting those two things together.
Information sits still. Story moves. A fact tells you what. A story tells you what, how it felt, what the consequences were, who it happened to. It gives you detail, texture... something for your neurons to latch on to. If we're pitting fact and story against each other, I can tell you now only one of those is gonna survive contact with stress.
Story isn't decoration. It's cognitive structure. It ties facts to emotions. It gives information somewhere to live. Somewhere it can be found again when the situation is messy or rushed or... human. Instructional training struggles because it asks people to remember rules when their brain is trying to just get through the moment without making things worse.
Story, on the other hand, doesn't ask to be remembered. It leaves a mark. A mark that allows it to show up later. As a hesitation before clicking on a link. As a "let me call you back" when you hear a weird request for information. It doesn't ask for perfect recall of a rule. It creates recognisable patterns.
That's not just awareness. That's instinct.
And if our goal, as it is with cyber training, is instilling the right behaviours under pressure... then information alone is never going to be enough. Because when it matters, people don't remember what they were told. They remember the story.
Keywords