The behave hub

The folly of predicting one person. The power of predicting a million

Behavioural data can't tell you what one person will do next Tuesday. But at scale, it reveals something far more useful – the conditions that make risky decisions more or less likely across entire populations. Oz Alashe explores why predicting the individual is the wrong question, and what actuaries, epidemiologists, and weather forecasters figured out long ago.

11 things RSA 2026 told us about the human side of cybersecurity

RSA 2026 made one thing clear: the human risk problem is accelerating faster than our ability to patch it. Here are 11 takeaways from the floor.

The anatomy of human risk

Security risk isn't just about attackers; it’s about pressure, friction, and the human behavior at the core of every control. Discover a new model for HRM.

You keep saying “the human side of cybersecurity.” Which one do you mean? (There are six.)

A common security phrase is slippery. CybSafe CEO Oz Alashe explores the “human side of cybersecurity” and outlines six ways people use the term

7 reasons why security awareness training is important in 2026

Data breaches cost UK organisations an average of £2.8 million. Human error, meanwhile, accounted for anywhere between 82% of those breaches. Those facts alone are usually enough to convince people security awareness training is important.

Raise the bar: 50 creative Cybersecurity Awareness Month ideas

The search is over! Our Cybersecurity Awareness Month guide is packed with ideas, examples, insights, and resources. Time to shine bright and make an impact.

Why “we already have that data” is bullsh*t

CybSafe’s CEO and founder Oz Alashe unpacks why your colleagues keep missing the point on behavioral risk – and what to do about it

What is Human Risk Management?

Human risk management (HRM) is a modern approach to solving workforce-related cyber challenges. It uses data to identify risky behaviors in real time and applies automated, personalized interventions to reduce the likelihood and impact of cyber incidents caused by people.

Understanding the UK Online Safety Act: Duties to protect children - now enforceable!

The UK Online Safety Act (OSA) is a landmark piece of legislation in the UK that is reshaping the digital landscape. It places a new "duty of care" on online platforms to protect their users from harmful content. It brings us one step further on CybSafe’s mission of making the internet a safer digital place. Here’s a summary of what the new law means for user safety and what it signals for the future of online platforms.

Wake-up call: the human element in the UK retail cyberattacks

The digital landscape has been buzzing with news of cyberattacks rocking the British retail sector. For many organisations, these headlines haven't just been news; they've been a stark, cold splash of reality, highlighting a threat that's not lurking in the shadows, but actively knocking at the digital door. The heightened alert around ransomware and other malicious cyber activities isn't just paranoia – it's a direct response to events that have tangible consequences. We're talking about significant financial losses, the erosion of hard-earned brand trust, operational paralysis, and the deeply concerning theft of sensitive data.

Tool or infrastructure? Why it matters for HRM

Most people in your position don’t recognize the difference between a tactical tool and strategic infrastructure. Or, to put it another way, between a point solution and a platform. Did we mention that this distinction really matters? Anyway, let’s get to the point (solution).

NIS2: Beefing up security for critical industries

So, you’ve probably heard whispers (or maybe full-blown announcements!) about this thing called NIS2. But what exactly is the NIS2 Directive, and why should you care?

Newsletter – All issues

The Behave newsletter, all editions. Human cyber risk? Measured. Behavioural science insights, delivered.

An open letter to CISOs & Security Leaders

The human side of cybersecurity is evolving. Fast. But there’s a good chance you might be stuck in the past.

Why security awareness still isn’t taken seriously (and how to fix it)

Let’s start with a painful truth: Security awareness, culture, and human risk professionals are often undervalued. Despite the rising threat of human-enabled cyber attacks, many organizations still treat addressing the human aspect as a checkbox.

Security metrics reboot: Less input, better output, real outcomes

Explaining the difference between inputs, outputs, and outcomes. Here’s the quick and simple way to break it down.

CybSafe book list: Books on the human aspect of cybersecurity, human risk management, security awareness, or security culture

Below are a selection of books written by authors who specialise in the human aspect of cybersecurity. Recommended reading for anyone who wants to specialise in this field or deepen their expertise.

Security awareness/security culture/human risk management specific job titles

This isn’t super scientific but we’ve been keeping tabs on ABC/HRM-specific job titles over the years.

How to increase the perceived value for what you do to manage human cyber risk

Security professionals often struggle to quantify and communicate the business impact of human cyber risk management. Below is a comprehensive list of real-world examples demonstrating how human cyber risk initiatives align with core business priorities.

The dogma of security awareness: Exposing cybersecurity’s biggest blind spot

This piece takes aim at “security awareness dogma”. You have been duly warned.It exposes why, despite good intentions and evidence to the contrary, most security leaders and security professionals remain closed-minded to the reality of the human aspect of cybersecurity.

Maximizing security awareness engagement: How the pros do it

The top mic-drop insights from our Cybersecurity Awareness Month engagement webinar. We assembled a uniquely expert panel with diverse backgrounds and roles. We invited them to spill their victories, wisdom, and yes, mistakes…all so they could help you detangle the engagement enigma.

Can BS make SA&T stick? Hot takes from the experts…

Using insights from “Oh, Behave!” to strengthen security training and drive lasting behavioral change. To arrive at the most useful answers, we hosted a webinar featuring a panel of indisputably impressive industry-leading experts.

How to talk like a human risk manager: Unleashing the language of credibility

Our recent thought-provoking webinar explored the power of words, the nuances of risk, threats, and vulnerabilities, and how being versed in this language can elevate your role as a human risk manager.

Maturing SA&T programs into human risk management strategies: The why, the how, and the expert wisdom

You know that feeling when something can’t keep up with the pace of modern life? That’s exactly where we are with traditional Security Awareness & Training (SA&T). It’s outdated, clunky, and struggling to stay relevant. In a recent CybSafe webinar, Jinan and CybSafe’s CEO, Oz Alashe, broke it all down: Why SA&T falls short (and has been for years); How HRM is different; How to begin the shift from SA&T to HRM in your organization.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

Oh, Behave! provides unmissable insights into people’s cybersecurity behaviors and attitudes, along with data-driven recommendations for businesses, policymakers, and individuals looking to manage human risk and strengthen their cybersecurity.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

The numbers don’t lie: Overwhelm and frustration with security measures are causing people to take more risks online. So how can you re-engage and empower users?

The frustration factor: Cybersecurity fatigue is shaping behavior…and not in a good way

Our latest eye-opening Oh, Behave! report shone a light on a worrying trend. People feel increasingly worn out by the constant pressure to stay secure. Of being bombarded with endless password changes, relentless software updates, and a never-ending stream of security alerts.

How to unlock CAM’s huge potential for behavior change

It’s the once-in-a-year opportunity where the spotlight shines bright on security. I wanted to take the opportunity to highlight some of the things CybSafe are doing to support organizations with their CAM initiatives, and call out the great work done by the National Cybersecurity Alliance.

CybSafe a leader in Forrester Wave™ Human Risk Management Solutions, Q3 2024

We’ll share a few reflections for organizations looking to embrace HRM. In Part 1, check out the three big things organizations should be laser-focused on before embarking an HRM strategy. Then in Part 2 we’ll gawp unreservedly at the vendor landscape, before wrapping it all up with some next steps that are as impactful as they are easy.

7 cybersecurity lessons from the 1950s

Based on his electrifying talk at IMPACT2024, this blog explores Danny’s 7 1950s-inspired principles to reach a much-needed balance between people and technology.

Interlinking GenAI and Human Cyber Risk

Generative artificial intelligence, or GenAI, is the term used to describe data-led algorithms (such as ChatGPT) that can be used to create new content, including audio, code, images, text, simulations, and videos. Recent accelerated developments in the field have created a tangible potential to drastically change the way we approach content creation.

Experts speak out: Four reasons your cyber risk strategy needs a reboot

What keeps human risk management experts up at night? Failing comms? Ineffective interventions? Technical blind spots? Or all of the above? Here’s the inside scoop.

Training derailed? Experts on the future of security awareness

Security training needs an upgrade. Three experts sat down at CybSafe’s IMPACT USA 2024 to share their wisdom and reimagine training. Here’s what happened.

The hidden cost of cybersecurity's “masculinity problem”

War & police: Is cybersecurity being held back by its obsession with masculine metaphors and language? We explore the latest findings and ponder alternative narratives

Demystifying the EU AI Act

The EU AI Act, also known as the Artificial Intelligence Act, is the world’s first comprehensive piece of legislation directly governing artificial intelligence (AI). It comes into effect in 2025 and brings with it strict requirements.

Demonstrating security awareness value to senior stakeholders

Secrets revealed: How to spin stale basic metrics into compelling stories that secure stakeholder buy-in for your program. Time to unleash the data dynamite

People are unique. Cybersecurity must treat them like it.

Every day, tech gets more personalized. But what is personal security awareness, why should you use it, and how? This essential guide’s got you covered.

Can fun personalization really change security behaviors?

What’s the deal with “gimmicks” and security awareness personalization? Here’s why you shouldn’t dismiss them, and how to make them work for you.

3 concepts that spell success in security awareness personalization

The psychology of personalized security awareness: How leveraging risk message, behavioral practice, and action planning can boost cybersecurity behaviors.

People don’t trust cybersecurity. And we don’t blame them

Is cybersecurity trust a distant dream? We look at new research that delves into the power of personalization and resonance to mend broken confidence.

Knowledge articulation: the secret sauce in GenAI for security awareness

Are you serious about mastering GenAI in your security awareness program? Then you need to understand the unseen force behind its magic: knowledge articulation

GenAI for security awareness: Can GenAI’s predictive analytics transform tired training?

GenAI’s data analytics lead to better security behaviors—that’s the power of prediction. But how can you turn this into smarter security awareness strategies?

GenAI for security awareness: What most people miss

Content creation is just the tip of the iceberg. Discover the ways Generative AI can make the biggest difference to your cybersecurity strategy and posture

The new SEC cybersecurity rules: What’s happened so far, how it’s changing security awareness, and what it means for you

The SEC's new rules scrutinize organizations’ security posture, from transparency to risk handling, and incident response. Are you ready for your close-up?

3 common causes of cyber crime and cyber attacks that show we’re making things too easy for today’s cyber criminals

While causes of cyber attacks vary, some are remarkably widespread. These 3 easily-preventable causes show how easy some criminals have it.

What DORA really means for financial institutions

CybSafe’s Annick O’Brien on how financial institutions can navigate DORA, a game-changing regulation for a resilient future. Are you ready for DORA's impact?

The difference between ‘risks’, ‘threats’ and ‘vulnerabilities’

Know the difference. Discuss risks more confidently with your security teams – as a genuine human risk specialist.

Artificial intelligence and cybersecurity: Opportunities and challenges

Equip your people against the evolving AI risks this Cybersecurity Awareness Month. Our AI curriculum, cybersecurity toolkit, and real-life examples make it a breeze.

The surprising damage cyberbullying does to organizations

Think cyberbullying only affects teenagers? Think again. It’s a gnarly security issue for organizations too—and it’s on the rise. Here’s what you can do about it.