Ask a psychologist whether psychological safety just means everyone being pleasant and you get a shrug, a yes, and then a correction: "It's not psychological safety if everybody's so nice there's never any challenge." She has worked in those groups. Everyone lovely, nothing done, nobody challenged. Then the number the episode hangs on, from her own Cranfield research into skill fade: "Anything that's procedural or decision-making, if you're not revamping those skills, 8 weeks we worked out was the gold... then those skills disappear." Every security behaviour sits in that category. "So why would you wanna do an annual module thing when it's not gonna last?"

Anything with the word mandatory on it loses her, and she's honest about why. "I'm lazy, and I'm busy. So anything that's not on my list and it's on your list is..." bottom of the pile. You can escalate, you can threaten people's jobs, and something will happen. "You'll comply, but you're not engaged." Compliance is the thing you can count. Engagement decides what happens at four o'clock on a Friday when nobody's checking. And if the message isn't landing? "Communication is not an at people, it's supposed to be with." Her test is blunt: if it didn't land the way you intended, you haven't communicated it properly. Not them. You.

Then she nearly got phished. Friday afternoon, end of a heavy week, one day after filing her first VAT return without her bookkeeper... and an email from HMRC about her VAT return. "I just immediately went, 'Oh my God. I've done something wrong.' Panic." It wasn't even a good fake. "All the red flags were like, 'Here we are.' And I just missed it." Her verdict on herself is the point: "I think that's normal." She didn't have a knowledge gap, she had a Friday. Which is why she wants blame out of the room altogether. When people aren't doing what you want, "it's data. They are telling you in a very, very subtle way that there's something wrong. Stop blaming them."