Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- In my last post, I argued that security awareness has become too clean. Too polished. Too predictable. Too focused on recognizing examples instead of developing judgment. Criticism is easy. The harder question is what we build instead. I don't think the answer is better graphics, and I don't think it's making every employee learn Linux or reverse malware. The problem isn't that security awareness isn't technical enough. It’s that we don’t give people enough opportunities to practice making decisions. I've been experimenting with a different model. It isn't one product or format, but a set of principles, mechanics, and techniques built around a premise: teach judgment. Not recognition of training, memorization of policy, or completion. Judgment. --- Start With the Decision A lot of tra...
Disclaimer: The views and opinions expressed are my own and do not reflect the views, policies, or positions of my employer or any organization with which I am affiliated. --- (Cyber)security awareness training (SAT) has long focused on recognizing threats inside the enterprise, but anyone who has dealt with a real compromise knows attacks rarely respect those boundaries. Real breaches are messy. They’re personal. They involve bad timing, strange messages, compromised friends, personal accounts, social media, reused credentials, AI-generated likenesses, family members, phone calls, desperation, embarrassment, deception, and sometimes outright threats or blackmail. Yet we teach security awareness with polished graphics, spotless templates, friendly AI-generated illustrations, and scenarios where the suspicious answer is practically given. What are we actually teaching people to recognize? The problem is that training today focuses too heavily on... Recognizing sp...