Same Slides, New Name

On why your culture programme is probably still an awareness programme

I’ve seen a lot of vendors recently pivot into ‘human risk management’ or ‘security culture transformation’. This pivot is usually accompanied by a freshly redesigned website, a new colour palette, and a blog post that looks like Gen Z ran it through a thesaurus and hoped no one would notice. And every time I see this metamorphosis, I sit and ponder… what has actually changed?

Because from where I’m sitting, and I have been sitting here for a while now watching this particular bit of theatre unfold, the answer for most of them is absolutely nothing of substance. The PowerPoint got a new title slide. The website swapped “awareness” for “culture” the same way a restaurant swaps “chips” for “frites” and adds three quid to the bill. The platform adds a dashboard that says “behaviour” on it somewhere, possibly in a new font that conveys “we’re modern… but serious”. And the training itself, the actual thing that lands in front of actual adult human beings who have actual jobs and actual attention spans and a thousand other things competing for their attention on a given Thursday? Yeah, that’s the same. Same modules. Same information. Same unshakeable assumption that if we tell people what to do, they will do it.

Sorry to break the bubble. But I’m calling bullshit. That assumption has always been wrong. It was wrong when it was dressed in compliance language, and it’s wrong now it’s been redressed in culture language. But at least we now have the data to prove it, clearly enough that I can stop being polite about this conversation.

A study from UC San Diego and the University of Chicago tested mandatory annual security training on 19,500 employees across multiple organisations. The result? A 1.7% improvement in phishing outcomes, which is, for practical purposes, zero. Not a weak correlation you could squint at and still possibly defend over a boardroom table. No measurable connection between the thing the entire industry has been doing for the better part of two decades and the outcome it was supposed to produce. That is not a crack in the model. That is the foundations admitting they were never really there.

There is no measurable connection between the thing the entire industry has been doing for the better part of two decades and the outcome it was supposed to produce.

And then… in March this year, the US Army, an institution whose entire operational model is built on drilling behaviour under pressure, repeatedly, until it holds in conditions where everything is going wrong… reduced its mandatory cybersecurity training requirement from annual to once every FIVE years. Their own internal analysis found no relational improvement in cybersecurity outcomes between annual training and less frequent alternatives. When an army decides its training isn’t worth doing annually, that is not a finding you can politely file away and carry on.

And yet the industry response to all of this is remarkably, almost admirably, consistent: do the same thing, change the name, and carry on as if conviction were a substitute for evidence.

Let’s talk about culture. Really talk about it. The word has been stretched so thin by marketing departments that it barely holds any shape at all. Culture is not a programme you deliver. Culture is not a set of values printed on a poster in a break room. Sigh. Culture is what people do when nobody is watching. When there is no module open, no assessment pending, no helpful reminder pinging into their inbox with an exclamation mark and an air of mild panic. Culture shows up in the conversations people have between training sessions, in the pub after work, in the corridor on the way to a meeting, in the small moments where someone pauses before clicking, or questions a request that seemed normal but landed wrong, or flags something to a colleague… not because a process told them to but because it felt like the right thing to do.

Culture is what people do when nobody is watching.

You cannot build that with slides. You cannot build it with an annual refresher that people click through like they are trying to get to the end of a terms and conditions page. And you absolutely cannot get there by renaming your existing awareness programme and hoping the new label does the heavy lifting.

So what does it actually take?

Three things. In order. And the order matters. We’ve been calling this the Behaviour Cycle, and the reason it’s a cycle rather than a checklist is that each stage creates the conditions the next one needs. You can’t shortcut it, and you can’t start in the middle.

First: engagement. I’ve waxed lyrical about this for the last few months. By now, I hope you know I don’t mean the sanitised, corporately acceptable version of engagement that means attendance, or completion, or someone managing to keep their eyes technically open while a narrator explains a password policy over stock footage of a person looking concerned at a laptop. Real engagement. Genuine emotional investment. The kind that only happens when something feels new and novel… when there are stakes or consequences that feel real even if they are simulated… when people are working together under pressure and the outcome actually seems to depend on what they do next.

Engagement is not about making training fun… although it is funny how defensive people get when you suggest that learning be anything other than mildly unpleasant. Engagement is about making it IMPOSSIBLE to ignore. The brain does not store information it doesn’t care about. Hermann Ebbinghaus mapped this in the 1880s, and a 2015 replication confirmed that without reinforcement or emotional significance, roughly half of new information is gone within an hour of passive learning. Within a week, up to 90% has evaporated. Not weakened. Gone. The module completed. The certificate is issued. The audit trail records training being done. The brain records… nothing useful.

You can repeat something a hundred times… but if the brain decided on first contact that this was background noise, repetition just makes it louder background noise. No amount of frequency fixes a relevance problem.

Second: culture. Real culture forms when behaviours become shared and repeatable, when a team develops a common language around risk that doesn’t sound like it was borrowed from a policy document. When “that felt dodgy” becomes something people actually say out loud, in a meeting, with other people there, in real life. And those other people nod rather than look at their shoes.

Culture doesn’t form during a training session any more than a friendship forms during a handshake. It forms between sessions, in the space where people process what happened, talk about what they noticed, and start to do things differently without anyone telling them to. It needs psychological safety. A culture lives or dies by the actions of its senior leaders, and no amount of knowledge, good will, or good intention can outperform a bollocking from your boss for checking whether he really did want you to send those confidential files to his personal email.

It needs social proof, and shared experience, and enough repetition that secure behaviour stops being the exception that gets praised and starts being the baseline. Because that’s what normal looks like around here.

Third: instinct. This is where the system diverges sharply from what the awareness industry has been selling. Instinct is behaviour that no longer requires conscious effort. Pattern recognition that fires before the rational mind has finished reading the email. Like a driver who brakes before they consciously registered the child stepping off the kerb. The information didn’t need to be recalled. It needed to be there already. Embedded, automatic, ready.

And then, only then, you get awareness. Not as a starting point. Not as a stage you deliver. As a result. Real awareness, the kind that actually protects organisations, is what the system produces when all three stages are working. It is the output, not the input. And treating it as the input is exactly why the current model keeps failing.

Real awareness, the kind that actually protects organisations, is what the system produces when all three stages are working. It is the output, not the input.

Gartner found that 41% of employees intentionally bypass cybersecurity controls. Not accidentally. Not through ignorance. Intentionally. And the instinct (you’ll pardon the pun) is to read that as a discipline problem. A training gap. A compliance failure that requires a sterner email from IT and perhaps a more prominently placed poster about consequences.

But let’s just… sit with it a moment. Proofpoint surveyed 7,500 people across 15 countries in 2024 and found that 71% had taken risky actions at work. Of those, 96% knew the action was dangerous when they took it. Read that again. 96% KNEW… and did it anyway. That is not a knowledge gap. That is an environment that has taught people, reliably and repeatedly, every working day, that the secure behaviour is the slow one, the awkward one, the one that makes you the person who replied-all asking if the attachment was legitimate while your colleagues got on with their afternoon.

What if 41% of your people have simply learned, through lived experience, that circumventing controls is faster and carries no real consequence, while following them occasionally makes it impossible to do the thing they were actually hired to do? That isn’t a failure of knowledge. Every single one of those people could probably pass a quiz on the policy they are circumventing. It’s a failure of environment. A design problem, not a people problem. And no amount of telling them the right answer will change what the environment is teaching them every single day.

Most of the industry is still treating human risk as a content problem. More modules. More reminders. More dashboards. More reports that nobody reads but everyone presents. The outcomes have not moved. And they will not, until we start designing for behaviour instead of awareness.

Here is what the evidence says actually works. KnowBe4 published benchmarking data last year across 14.5 million users and 67.7 million simulated phishing tests. Continuous immersive training reduced phishing susceptibility from a 33.1% baseline to 4.1% within 12 months. That is an 86% reduction. The same research period, the same types of employees, the same threat landscape, except with a programme designed around engagement, repetition, and real consequence rather than completion certificates.

86% versus 1.7%. That is not a marginal difference in return on investment. That is the difference between a programme that works and one that just works on paper.

Over the coming weeks in this newsletter, I’m going to lay out exactly what a genuine security culture programme looks like, what it requires at each stage, what the evidence says about the conditions that actually produce behaviour change, and what you should probably stop wasting budget on immediately. I’ll be honest about what’s hard, what takes time, and what the organisations that are genuinely ahead of the curve are doing differently.

This might ruffle some feathers. Good. The feathers have had long enough.