When Nobody’s Watching is the name of our new podcast. It’s also the whole problem, in four words. So I opened episode one with a confession.

Holly-Jane Grayling builds security awareness and culture for a living. She has spent over a decade on why people do what they do. And she has clicked her own phishing simulation.

Not someone else’s. Hers. The one she built. She was rushed, mid-task, already being chased to finish her own mandatory module, and an email landed at exactly the wrong second. Click.

If the person who designs the tests, who knows every trick, who could give you the whole taxonomy of a phishing lure off the top of her head… if she still clicks, what the fuck is one more module supposed to do for the rest of us?

The answer is in how the brain actually runs the day. You’ve got two systems up there. One is fast, automatic and always on. It reads the room, matches patterns, and fires a response before you’ve consciously decided anything. It’s the part that’s driving at 4pm on a Friday when you’re tired and behind… and forty tabs deep. The other one is slow, careful and effortful. It weighs things up. It reads the policy. It notices the sender address is one character off.

Now… which of those two do you think your training is talking to?

The slow one. Every time. We sit people in a quiet room, on a calm morning, and we carefully explain things to the deliberate, reasoning brain. And it works… in that room. The trouble is the attack never arrives in that room. It arrives mid-task, under pressure, when the slow brain has clocked off and the fast one is running everything on autopilot. The knowledge was there the whole time. It just wasn’t the part of the brain holding the wheel.

That’s why Holly clicked. Not a knowledge gap (obviously). But a systems mismatch. We keep feeding the reasoning brain more facts and then acting surprised when the reflex brain, the one actually on shift when it matters, does something the facts would never have allowed.

So what talks to the fast brain? Not information, it doesn’t speak that language. The fast brain learns the way you learned to hit the brakes before you crash the car. Repetition, under something close to real conditions, until the right move happens on its own. That’s what an instinct is. A response you don’t have to reach for. You cannot read your way to one, and you certainly can’t “click-through-a-module” your way to one.

Which is the whole point. If the moment that decides everything belongs to the fast, automatic brain, then everything aimed only at the slow one is (at best) half the job. It feels productive. It looks great on a dashboard. And it’s talking to a part of the mind that won’t be in the room when it really counts.

Holly’s episode is out on Wednesday, and she says all of this better than I can, as someone who’s lived it from the inside. Go and watch it. And then have an honest look at your own programme and ask the only question that matters… which brain is it actually talking to?