Blog

Shifting sands: The move from HRM to secure behaviour management

Gartner says ditch security awareness for secure behaviour management (SBM). Forrester calls it human risk management (HRM). Here's where the market is heading, and why the work matters more than the name.

Raise the bar: 50 creative Cybersecurity Awareness Month ideas

The search is over! Our Cybersecurity Awareness Month guide is packed with ideas, examples, insights, and resources. Time to shine bright and make an impact.

These 7 red flags reveal you're stuck in awareness rather than truly managing human risk

Awareness tells people things. HRM and SBM change what they do. These 7 signs show where you're stuck and how to prove real risk reduction.

The folly of predicting one person. The power of predicting a million

Behavioural data can't tell you what one person will do next Tuesday. But at scale, it reveals something far more useful – the conditions that make risky decisions more or less likely across entire populations. Oz Alashe explores why predicting the individual is the wrong question, and what actuaries, epidemiologists, and weather forecasters figured out long ago.

11 things RSA 2026 told us about the human side of cybersecurity

RSA 2026 made one thing clear: the human risk problem is accelerating faster than our ability to patch it. Here are 11 takeaways from the floor.

The anatomy of human risk

Security risk isn't just about attackers; it’s about pressure, friction, and the human behavior at the core of every control. Discover a new model for HRM.

You keep saying “the human side of cybersecurity.” Which one do you mean? (There are six.)

A common security phrase is slippery. CybSafe CEO Oz Alashe explores the “human side of cybersecurity” and outlines six ways people use the term

7 reasons why security awareness training is important in 2026

Data breaches cost UK organisations an average of £2.8 million. Human error, meanwhile, accounted for anywhere between 82% of those breaches. Those facts alone are usually enough to convince people security awareness training is important.

Why “we already have that data” is bullsh*t

CybSafe’s CEO and founder Oz Alashe unpacks why your colleagues keep missing the point on behavioral risk – and what to do about it

What is Human Risk Management?

Human risk management (HRM) is a modern approach to solving workforce-related cyber challenges. It uses data to identify risky behaviors in real time and applies automated, personalized interventions to reduce the likelihood and impact of cyber incidents caused by people.

Understanding the UK Online Safety Act: Duties to protect children - now enforceable!

The UK Online Safety Act (OSA) is a landmark piece of legislation in the UK that is reshaping the digital landscape. It places a new "duty of care" on online platforms to protect their users from harmful content. It brings us one step further on CybSafe’s mission of making the internet a safer digital place. Here’s a summary of what the new law means for user safety and what it signals for the future of online platforms.

Wake-up call: the human element in the UK retail cyberattacks

The digital landscape has been buzzing with news of cyberattacks rocking the British retail sector. For many organisations, these headlines haven't just been news; they've been a stark, cold splash of reality, highlighting a threat that's not lurking in the shadows, but actively knocking at the digital door. The heightened alert around ransomware and other malicious cyber activities isn't just paranoia – it's a direct response to events that have tangible consequences. We're talking about significant financial losses, the erosion of hard-earned brand trust, operational paralysis, and the deeply concerning theft of sensitive data.

Tool or infrastructure? Why it matters for HRM

Most people in your position don’t recognize the difference between a tactical tool and strategic infrastructure. Or, to put it another way, between a point solution and a platform. Did we mention that this distinction really matters? Anyway, let’s get to the point (solution).

NIS2: Beefing up security for critical industries

So, you’ve probably heard whispers (or maybe full-blown announcements!) about this thing called NIS2. But what exactly is the NIS2 Directive, and why should you care?

Newsletter – All issues

The Unfiltered Signals newsletter, all editions. Human cyber risk? Measured. Behavioural science insights, delivered.

An open letter to CISOs & Security Leaders

The human side of cybersecurity is evolving. Fast. But there’s a good chance you might be stuck in the past.

Why security awareness still isn’t taken seriously (and how to fix it)

Let’s start with a painful truth: Security awareness, culture, and human risk professionals are often undervalued. Despite the rising threat of human-enabled cyber attacks, many organizations still treat addressing the human aspect as a checkbox.

Security metrics reboot: Less input, better output, real outcomes

Explaining the difference between inputs, outputs, and outcomes. Here’s the quick and simple way to break it down.

CybSafe book list: Books on the human aspect of cybersecurity, human risk management, security awareness, or security culture

Below are a selection of books written by authors who specialise in the human aspect of cybersecurity. Recommended reading for anyone who wants to specialise in this field or deepen their expertise.

Security awareness/security culture/human risk management specific job titles

This isn’t super scientific but we’ve been keeping tabs on ABC/HRM-specific job titles over the years.

How to increase the perceived value for what you do to manage human cyber risk

Security professionals often struggle to quantify and communicate the business impact of human cyber risk management. Below is a comprehensive list of real-world examples demonstrating how human cyber risk initiatives align with core business priorities.

The dogma of security awareness: Exposing cybersecurity’s biggest blind spot

This piece takes aim at “security awareness dogma”. You have been duly warned.It exposes why, despite good intentions and evidence to the contrary, most security leaders and security professionals remain closed-minded to the reality of the human aspect of cybersecurity.

Maximizing security awareness engagement: How the pros do it

The top mic-drop insights from our Cybersecurity Awareness Month engagement webinar. We assembled a uniquely expert panel with diverse backgrounds and roles. We invited them to spill their victories, wisdom, and yes, mistakes…all so they could help you detangle the engagement enigma.

Can BS make SA&T stick? Hot takes from the experts…

Using insights from “Oh, Behave!” to strengthen security training and drive lasting behavioral change. To arrive at the most useful answers, we hosted a webinar featuring a panel of indisputably impressive industry-leading experts.

How to talk like a human risk manager: Unleashing the language of credibility

Our recent thought-provoking webinar explored the power of words, the nuances of risk, threats, and vulnerabilities, and how being versed in this language can elevate your role as a human risk manager.

Maturing SA&T programs into human risk management strategies: The why, the how, and the expert wisdom

You know that feeling when something can’t keep up with the pace of modern life? That’s exactly where we are with traditional Security Awareness & Training (SA&T). It’s outdated, clunky, and struggling to stay relevant. In a recent CybSafe webinar, Jinan and CybSafe’s CEO, Oz Alashe, broke it all down: Why SA&T falls short (and has been for years); How HRM is different; How to begin the shift from SA&T to HRM in your organization.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

Oh, Behave! provides unmissable insights into people’s cybersecurity behaviors and attitudes, along with data-driven recommendations for businesses, policymakers, and individuals looking to manage human risk and strengthen their cybersecurity.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

The numbers don’t lie: Overwhelm and frustration with security measures are causing people to take more risks online. So how can you re-engage and empower users?

The frustration factor: Cybersecurity fatigue is shaping behavior…and not in a good way

Our latest eye-opening Oh, Behave! report shone a light on a worrying trend. People feel increasingly worn out by the constant pressure to stay secure. Of being bombarded with endless password changes, relentless software updates, and a never-ending stream of security alerts.

How to unlock CAM’s huge potential for behavior change

It’s the once-in-a-year opportunity where the spotlight shines bright on security. I wanted to take the opportunity to highlight some of the things CybSafe are doing to support organizations with their CAM initiatives, and call out the great work done by the National Cybersecurity Alliance.

CybSafe a leader in Forrester Wave™ Human Risk Management Solutions, Q3 2024

We’ll share a few reflections for organizations looking to embrace HRM. In Part 1, check out the three big things organizations should be laser-focused on before embarking an HRM strategy. Then in Part 2 we’ll gawp unreservedly at the vendor landscape, before wrapping it all up with some next steps that are as impactful as they are easy.

7 cybersecurity lessons from the 1950s

Based on his electrifying talk at IMPACT2024, this blog explores Danny’s 7 1950s-inspired principles to reach a much-needed balance between people and technology.

Interlinking GenAI and Human Cyber Risk

Generative artificial intelligence, or GenAI, is the term used to describe data-led algorithms (such as ChatGPT) that can be used to create new content, including audio, code, images, text, simulations, and videos. Recent accelerated developments in the field have created a tangible potential to drastically change the way we approach content creation.

Experts speak out: Four reasons your cyber risk strategy needs a reboot

What keeps human risk management experts up at night? Failing comms? Ineffective interventions? Technical blind spots? Or all of the above? Here’s the inside scoop.

Training derailed? Experts on the future of security awareness

Security training needs an upgrade. Three experts sat down at CybSafe’s IMPACT USA 2024 to share their wisdom and reimagine training. Here’s what happened.

The hidden cost of cybersecurity's “masculinity problem”

War & police: Is cybersecurity being held back by its obsession with masculine metaphors and language? We explore the latest findings and ponder alternative narratives

Demystifying the EU AI Act

The EU AI Act, also known as the Artificial Intelligence Act, is the world’s first comprehensive piece of legislation directly governing artificial intelligence (AI). It comes into effect in 2025 and brings with it strict requirements.

Demonstrating security awareness value to senior stakeholders

Secrets revealed: How to spin stale basic metrics into compelling stories that secure stakeholder buy-in for your program. Time to unleash the data dynamite

People are unique. Cybersecurity must treat them like it.

Every day, tech gets more personalized. But what is personal security awareness, why should you use it, and how? This essential guide’s got you covered.

Can fun personalization really change security behaviors?

What’s the deal with “gimmicks” and security awareness personalization? Here’s why you shouldn’t dismiss them, and how to make them work for you.

3 concepts that spell success in security awareness personalization

The psychology of personalized security awareness: How leveraging risk message, behavioral practice, and action planning can boost cybersecurity behaviors.

People don’t trust cybersecurity. And we don’t blame them

Is cybersecurity trust a distant dream? We look at new research that delves into the power of personalization and resonance to mend broken confidence.

Knowledge articulation: the secret sauce in GenAI for security awareness

Are you serious about mastering GenAI in your security awareness program? Then you need to understand the unseen force behind its magic: knowledge articulation

GenAI for security awareness: Can GenAI’s predictive analytics transform tired training?

GenAI’s data analytics lead to better security behaviors—that’s the power of prediction. But how can you turn this into smarter security awareness strategies?

GenAI for security awareness: What most people miss

Content creation is just the tip of the iceberg. Discover the ways Generative AI can make the biggest difference to your cybersecurity strategy and posture

The new SEC cybersecurity rules: What’s happened so far, how it’s changing security awareness, and what it means for you

The SEC's new rules scrutinize organizations’ security posture, from transparency to risk handling, and incident response. Are you ready for your close-up?

3 common causes of cyber crime and cyber attacks that show we’re making things too easy for today’s cyber criminals

While causes of cyber attacks vary, some are remarkably widespread. These 3 easily-preventable causes show how easy some criminals have it.

What DORA really means for financial institutions

CybSafe’s Annick O’Brien on how financial institutions can navigate DORA, a game-changing regulation for a resilient future. Are you ready for DORA's impact?

The difference between ‘risks’, ‘threats’ and ‘vulnerabilities’

Know the difference. Discuss risks more confidently with your security teams – as a genuine human risk specialist.

Artificial intelligence and cybersecurity: Opportunities and challenges

Equip your people against the evolving AI risks this Cybersecurity Awareness Month. Our AI curriculum, cybersecurity toolkit, and real-life examples make it a breeze.

The surprising damage cyberbullying does to organizations

Think cyberbullying only affects teenagers? Think again. It’s a gnarly security issue for organizations too—and it’s on the rise. Here’s what you can do about it.

Employment identity theft: When a personal data heist becomes a professional-level problem

Identity theft—it’s nothing new, but it’s a growing threat . . . and it can send shockwaves through your organization. Here’s what you need to know about the risks, statistics, and how to build resilience.

The thing letting your security awareness training down

The key to a strong security posture? Just like keeping healthy, it’s not glamorous, and it’s sometimes hard work. But it could just stop you ending up in cyber resus.

From home sweet home to home safe home: How to maintain security when employees work remotely

It’s the new norm and it’s a popular choice, but remote working can be risky. Here’s how to safeguard your organization from a home invasion horror story.

The official guide to CybSafe products and pricing

A guide to GUIDE, PHISH, and RESPOND—the CybSafe products that help you achieve compliance, influence specific security behaviors, and reduce human cyber risk.

The ripple effect: How one phishing attack can cause disaster across your organization

Phishing attacks are on the rise. In 2020, 93% of UK organisations were targeted by Covid-19-related malware. 88% of security professionals reported an increase in phishing attacks. Typically, criminals behind phishing attacks aren’t attempting to steal money. They’re attempting to steal something potentially much more valuable: data. When phishing attacks trigger data breaches, the consequences for businesses can be severe.

AI companion or cybersecurity nightmare? Is ChatGPT safe to use?

ChatGPT is the undisputed new AI darling . . . and it poses some sizable cyber risks. But with the right approach you can protect yourself, your people, and your organization.

You and whose army? You can’t outsmart ransomware attacks alone

Ransomware is a nasty threat and even world-class giants have been knocked flying. How can you help your organization stay on its feet? Spoiler: it doesn’t involve boring PowerPoints

Train smart, not hard! The intelligent approach to phishing training

Three things about phishing training? One, it’s absolutely essential. Two, you’re probably making it harder than it needs to be. And three, we’ve got a fix.

Measuring the effectiveness of security awareness programs: What you need to know

Measuring the effectiveness of awareness training is difficult. Learn how companies typically track the effectiveness of their security training

5 big factors in a strong cybersecurity culture

A strong security culture is a major part of your organization’s cyber resilience. But how can you define and measure it—and what are the sticking points?

Top 4 types of security awareness training – and the pros and cons of each

Get up close with the main four types of security awareness training. We weigh the pros and cons, latest trends, and how to pick a program that works for your organization.

Ransomware trends 2023: Predictions for this year and beyond

What recent ransomware attacks reveal about today’s ransomware threats—and the often-overlooked approach that leaves ransomware attackers empty-handed.

Human-centered security: Why a cyber strategy should prioritize people

How can a human-centered approach help reduce cyber risk? And why does investing in people and behaviors make a difference? CybSafe’s CEO has got the answers.

Executive phishing exposed: prevention tactics for your C-suite

Executive phishing and whaling can cost organizations millions and damages reputations. Here’s how to help your people avoid falling victim to a cyber criminal..

6 ways to make your security nudges better

Cybersecurity nudges can help you influence long-term security behaviors. But they can also be detrimental to your people. Here’s how to get security nudges right.

What ransomware as a service (RaaS) means for security teams

The rise of ransomware as a service is part of the ever-changing face of the biggest cyber threat. What can your team do to counter the latest advancements?

Who is responsible for developing a cybersecurity culture?

Culture is one of the most important, but oft-overlooked aspects of cybersecurity. Here’s a primer on getting culture change off the ground in your organization.

Why cybersecurity is a life skill

Like it or not, cybersecurity is just one of those things we gotta do. But we need people’s help to do it right. Here’s how to get your organization’s cybersecurity on the right track.

We need human solutions to address human cyber risk

Technology alone won't solve human cyber risk. We need solutions designed for people — ones rooted in behavioural science, not just awareness training.

Enhancing a cybersecurity team’s reputation: Communication and policies

Security teams that communicate well and build strong policies earn more than compliance — they earn trust. Here's how to enhance your team's reputation from the inside out.

How to get ransomware remediation and protection right

Cybersecurity trailblazers are playing ransomware attackers at their own game . . . and beating them. Here are a few tips to show you how you can do it too.

Digital Operational Resilience Act (DORA) must-knows for everyone

How the EU Digital Operational Resilience Act (DORA) will bring much-needed change to cybersecurity practices in Europe’s financial institutions, and beyond.

Ransomware: The Ultimate Guide for 2023

How to safeguard your data from ransomware attacks. An up-to-date, detailed guide. Stay safe online - start reading now!

Romance scams: The stats, and what they mean for your organization

A shocking number of people fall victim to romance scams. Who are they, why did it happen, and what does it all mean for human risk management?

Romance fraud: How your people’s personal lives could affect your cyber risk

Security awareness professionals are constantly shoring up their human layer defenses. However, romance scams tend to fly under the radar. Let’s change that.

Nudge science: The behavioral research behind security nudges

A primer on cybersecurity nudges, or, “behavior nudges”. Find out what they are, how they work, and what they can do for your human risk management efforts.

When nudge security is a waste of time

Security nudges exist to make the job a little easier for cybersecurity professionals. But, as with any tool, there’s a right way and a wrong way to use a nudge.

Top five examples of nudge theory in action

Nudge theory may have only gained popularity in cybersecurity recently, but people have been relying on it to help them complete everyday tasks for years.

Rational choices in cybersecurity: Navigating the metrics of human cyber risk

Many things in life can be measured. Our height, the distance we ran, how short our last relationship was… It’s no different when it comes to cyber security. Human-cyber risk can be measured. But where do you begin? Pull up a chair and grab a snack, let’s explore the wonderful world of metrics!

Why Gen Z doesn’t care about cybersecurity

Gen Z grew up online — so why don't they follow basic cybersecurity practices? The answer might surprise security teams still relying on traditional training methods.

How to strengthen your cybersecurity with user research

User research isn't just for product teams. Applying it to cybersecurity helps you understand real behaviour, design better interventions, and reduce human risk at scale.

Security awareness is dead: 4 things holding your organization back

Security awareness isn’t everything. It’s taken the industry a long time to admit it. And it’ll take most organizations a long time to accept it. Don’t let yours be one of them.

How to make data backups a regular part of everyone’s day

A strong backup game can be the difference between success and bankruptcy. And behavioral research holds the key.

Long read: CybSafe's 2023 security awareness predictions

2022 has come and gone. But we’re not here to dwell. We’re looking to the future. To all things security awareness in 2023. You’re going to want to read this.

Achievement unlocked: How behavioral science transforms device security

People lock their houses, their cars, and even their sheds full of worthless junk. So why don’t they lock their devices?

Why people are so attached to their dirty password habits

Password hygiene advice is everywhere — yet bad habits persist. Understanding the psychology behind attachment to familiar (if risky) behaviours is the first step to changing them.

Survey says: RIP traditional security awareness and training

New research signals the end of traditional security awareness and training as we know it. Find out what employees really think — and what a better approach looks like.

Stealing your company’s data is a piece of cake

VPNs are hardworking guardians of private data. Why are they still a mystery to so many people?

Your cyber security goals are worthless. There, we said it

Cybersecurity is about so much more than goals and awareness. Our latest webinar helps you actually reduce your human risk.

Why are your people still snoozing updates?

It’s as simple as it is effective, and it could save your organization millions. So, why won’t everyone on the team enable auto-updates?