The behave hub

These 7 red flags reveal you're stuck in awareness rather than truly managing human risk

Awareness tells people things. HRM and SBM change what they do. These 7 signs show where you're stuck and how to prove real risk reduction.

The folly of predicting one person. The power of predicting a million

Behavioural data can't tell you what one person will do next Tuesday. But at scale, it reveals something far more useful – the conditions that make risky decisions more or less likely across entire populations. Oz Alashe explores why predicting the individual is the wrong question, and what actuaries, epidemiologists, and weather forecasters figured out long ago.

11 things RSA 2026 told us about the human side of cybersecurity

RSA 2026 made one thing clear: the human risk problem is accelerating faster than our ability to patch it. Here are 11 takeaways from the floor.

The anatomy of human risk

Security risk isn't just about attackers; it’s about pressure, friction, and the human behavior at the core of every control. Discover a new model for HRM.

You keep saying “the human side of cybersecurity.” Which one do you mean? (There are six.)

A common security phrase is slippery. CybSafe CEO Oz Alashe explores the “human side of cybersecurity” and outlines six ways people use the term

7 reasons why security awareness training is important in 2026

Data breaches cost UK organisations an average of £2.8 million. Human error, meanwhile, accounted for anywhere between 82% of those breaches. Those facts alone are usually enough to convince people security awareness training is important.

Raise the bar: 50 creative Cybersecurity Awareness Month ideas

The search is over! Our Cybersecurity Awareness Month guide is packed with ideas, examples, insights, and resources. Time to shine bright and make an impact.

Why “we already have that data” is bullsh*t

CybSafe’s CEO and founder Oz Alashe unpacks why your colleagues keep missing the point on behavioral risk – and what to do about it

What is Human Risk Management?

Human risk management (HRM) is a modern approach to solving workforce-related cyber challenges. It uses data to identify risky behaviors in real time and applies automated, personalized interventions to reduce the likelihood and impact of cyber incidents caused by people.

Understanding the UK Online Safety Act: Duties to protect children - now enforceable!

The UK Online Safety Act (OSA) is a landmark piece of legislation in the UK that is reshaping the digital landscape. It places a new "duty of care" on online platforms to protect their users from harmful content. It brings us one step further on CybSafe’s mission of making the internet a safer digital place. Here’s a summary of what the new law means for user safety and what it signals for the future of online platforms.

Wake-up call: the human element in the UK retail cyberattacks

The digital landscape has been buzzing with news of cyberattacks rocking the British retail sector. For many organisations, these headlines haven't just been news; they've been a stark, cold splash of reality, highlighting a threat that's not lurking in the shadows, but actively knocking at the digital door. The heightened alert around ransomware and other malicious cyber activities isn't just paranoia – it's a direct response to events that have tangible consequences. We're talking about significant financial losses, the erosion of hard-earned brand trust, operational paralysis, and the deeply concerning theft of sensitive data.

Tool or infrastructure? Why it matters for HRM

Most people in your position don’t recognize the difference between a tactical tool and strategic infrastructure. Or, to put it another way, between a point solution and a platform. Did we mention that this distinction really matters? Anyway, let’s get to the point (solution).

NIS2: Beefing up security for critical industries

So, you’ve probably heard whispers (or maybe full-blown announcements!) about this thing called NIS2. But what exactly is the NIS2 Directive, and why should you care?

Newsletter – All issues

The Behave newsletter, all editions. Human cyber risk? Measured. Behavioural science insights, delivered.

An open letter to CISOs & Security Leaders

The human side of cybersecurity is evolving. Fast. But there’s a good chance you might be stuck in the past.

Why security awareness still isn’t taken seriously (and how to fix it)

Let’s start with a painful truth: Security awareness, culture, and human risk professionals are often undervalued. Despite the rising threat of human-enabled cyber attacks, many organizations still treat addressing the human aspect as a checkbox.

Security metrics reboot: Less input, better output, real outcomes

Explaining the difference between inputs, outputs, and outcomes. Here’s the quick and simple way to break it down.

CybSafe book list: Books on the human aspect of cybersecurity, human risk management, security awareness, or security culture

Below are a selection of books written by authors who specialise in the human aspect of cybersecurity. Recommended reading for anyone who wants to specialise in this field or deepen their expertise.

Security awareness/security culture/human risk management specific job titles

This isn’t super scientific but we’ve been keeping tabs on ABC/HRM-specific job titles over the years.

How to increase the perceived value for what you do to manage human cyber risk

Security professionals often struggle to quantify and communicate the business impact of human cyber risk management. Below is a comprehensive list of real-world examples demonstrating how human cyber risk initiatives align with core business priorities.

The dogma of security awareness: Exposing cybersecurity’s biggest blind spot

This piece takes aim at “security awareness dogma”. You have been duly warned.It exposes why, despite good intentions and evidence to the contrary, most security leaders and security professionals remain closed-minded to the reality of the human aspect of cybersecurity.

Maximizing security awareness engagement: How the pros do it

The top mic-drop insights from our Cybersecurity Awareness Month engagement webinar. We assembled a uniquely expert panel with diverse backgrounds and roles. We invited them to spill their victories, wisdom, and yes, mistakes…all so they could help you detangle the engagement enigma.

Can BS make SA&T stick? Hot takes from the experts…

Using insights from “Oh, Behave!” to strengthen security training and drive lasting behavioral change. To arrive at the most useful answers, we hosted a webinar featuring a panel of indisputably impressive industry-leading experts.