Under Pressure

Attackers do not send you a quiz.

They send you urgency, dressed as credibility. They send you plausibility. They send you something that looks like a Tuesday afternoon. And Tuesday afternoon, for me anyway, is busy.

We continue to train people as if breaches happen in silence and perfect lighting. But they don’t. They happen mid-task. When our brains are optimising for speed, not scrutiny. And that’s precisely why realistic pressure beats theoretical knowledge every single time.

The human brain under pressure doesn’t behave like the human brain in a training session. Under pressure, we don’t become wiser. We become faster. Faster is heuristic. Faster is emotional. Faster is the mental equivalent of grabbing the first coat by the door when it’s raining and you’re already late… you’re not looking at fabrics and whether it matches your outfit. You’re escaping weather.

Theoretical knowledge on the other hand? That lives in calm air. It thrives on tidy bullet points and reassuring frameworks. It loves phrases like “best practice” and “policy adherence”. But cyber incidents don’t arrive wearing name badges. They arrive sounding like your CFO. They arrive referencing real projects. They arrive five minutes before a deadline. They exploit the fact that you are a real human person with competing priorities, not a compliance robot humming gently in a risk-free vacuum.

In calm conditions, we all say we’d report a suspicious email. But under time pressure with Teams pinging, phones ringing, and someone asking where those numbers are.. that’s when hesitation creeps in. “It looks legit.” “I’ll check it later.” “It’s probably fine.” And it’s that hesitation which is the breach-shaped crack in the wall. Attackers don’t hack systems first. They hack tempo. Increase speed and judgement thins.

Newsflash: you can’t simulate that with a PowerPoint.

Policies can’t replicate adrenaline. A multiple-choice quiz can’t mimic the tension between looking a bit daft and making a decision. Only realistic pressure does that. Only immersive challenge forces the brain to reconcile what it knows with what it actually does.

Think of it like swimming. Reading about swimming is not the same as being thrown into cold water. In theory, you might know the strokes. You know how to move your arms and legs. You know the goal is not to drown… You get the concept. But in practice? The temperature steals your breath and your body has to decide whether to trust the training.

Pressure reveals culture too. It exposes who defers… who dominates… who freezes… who improvises. It shows whether “security is everyone’s responsibility” is a lived reflex or a laminated slogan. Under strain, hierarchy bends, habits surface, and the gap between values and behaviour becomes painfully visible. You cannot fake instinct. And instinct is what incidents test.

There is something refreshingly honest about this. In a classroom, everyone is a model citizen. Under pressure, passwords are reused. Rationalisations bloom. Overconfidence struts in and trips over its own shoelaces. It is uncomfortable. Good. Comfort has never been a serious security control.

The real shift happens afterwards. When people feel consequence, even in a simulated environment, the memory sticks. Stress, handled safely, creates imprint. Weeks later, someone pauses before clicking because their body remembers the sensation of getting it wrong. Not the slide. The feeling.

If we want behaviour to change, we must train behaviour, not just knowledge. Behaviour lives in messy, human, time-pressured reality. It lives in ego and fatigue, in social dynamics and in the split second between “this feels odd” and “I’ll deal with it later.” That split second cannot be rewritten with theory alone.

Knowledge is necessary. Pressure is transformative. If your training never raises a pulse, it will never change a habit.

And in cyber, habits are everything.