Articles Archives

people-working-in-sunlit-office-workspace

Article | Articles

When Phishing Simulations Stop Teaching

Phishing simulations are declining in effectiveness in cyber security strategies and people-centred approaches are gaining popularity.

man-holding-turned-on-ipad-in-front-of-turned-off-macbook-air

Article | Articles

The Things People Hate Most About Cyber Security

Research has found that employees can have distinctly negative perceptions of security awareness training.

Article | Articles

Cyber Security Advice Fatigue: Why People Stop Listening

Please add an excerpt to this post for better display.

Article | Articles

The Needle Needs to Move: Why AI Has Changed the Moment for Cyber Security

Please add an excerpt to this post for better display.

A group of coworkers sitting around a table

Article | Articles

From knowing to doing: the case for Secure Behaviour Management

How can Secure Behaviour Management turn security knowledge into better decisions?

A table of people smiling with their laptops opened in front of them

Article | Articles

Why Secure Behaviour Management is becoming the channel’s next growth opportunity

As security becomes more complex, could the channel’s next opportunity lie in understanding how people actually use the technology?

A man sits in front of his desk at his office late at night and has an exhausted expression on his face

Article | Articles

If Employees Are the Human Firewall, What Are They Protecting?

If employees are the human firewall, what are they protecting, and what do they take with them?

Article | Articles

Measure Twice, Cut Once: Why Cyber Security Needs a Baseline

The value of baselining behaviours cannot be understated in building success cyber security interventions

Article | Articles

Everything You Know About Nudges Is Wrong

What happens when the word 'nudge' becomes so broad that it stops telling us anything useful?

A desk with two people working on their laptops

Article | Articles

Is AI bad for cyber security?

A useful way to think about AI in cyber security is as a way of creating more capacity for human...

A man stares at his laptop looking bored and frustrated.

Article | Articles

Has cyber security training outlived its usefulness?

Organisations can create more frequent opportunities for people to encounter, absorb and apply relevant information as part of their everyday...

Article | Articles

Why Secure Behaviour Management isn’t just another cyber security buzzword

The term 'Secure Behaviour Management' is emerging as a new way of describing a more active, people-centred approach to cyber...

A diverse team of adults collaborating over a laptop in a bright, modern office.

Article | Articles

Security Culture Is Built in the Moments People Almost Miss

Security culture grows when timely support makes safer choices easier to notice and repeat daily.

A diverse group of professionals working together in a modern office setting, fostering creativity and teamwork.

Article | Articles

Nudge Theory Examples That Actually Belong in Cyber Security

Nudges work best when they preserve judgement at the exact moment pressure narrows it most.

A pensive woman in business attire sits at a desk with a laptop, contemplating work

Article | Articles

What Is Human Risk Management, Really?

Human risk management gives security teams clearer evidence of behaviour, pressure and prioritised support needs.

Three colleagues sitting at a table working on laptops in a vibrant, urban office space.

Article | Articles

Social Engineering Has Changed, So Security Awareness Training Has To

Please add an excerpt to this post for better display.

Young woman enjoying a snack while working on a laptop in a casual office setting.

Article | Articles

Where Phishing Simulation Falls Short of Real-Time Behaviour Change

Phishing simulation improves when it reflects real context, psychological safety and behaviour change under pressure.

Office environment with diverse team members brainstorming and collaborating on a project.

Article | Articles

Why Visibility Should Come Before Control

Visibility before control helps organisations understand workarounds before they harden into hidden risky behaviour patterns.

A diverse group of professionals attentively listening during an indoor business meeting in a modern conference room.

Article | Articles

The EAST Framework and the Case for Easier Secure Behaviour

The EAST framework helps security teams make safer behaviour easier in the moments people decide.

A couple sharing a supportive and thoughtful moment indoors, reflecting love and care.

Article | Articles

What Data Breach Patterns Tell Us About Human Risk

Data breach patterns often reveal pressure, friction and missed chances to support safer decisions earlier.

Man showing stress and frustration while working remotely on a laptop indoors.

Article | Articles

Why Phishing Training Has to Catch Up with AI-Powered Attacks

AI phishing demands training that reflects real pressure, plausible context and timely support in practice.

An open leather backpack with a laptop on a wooden bench surrounded by autumn leaves.

Article | Articles

Shadow AI Is a Visibility Problem Before It’s a Policy Problem

Shadow AI becomes governable when organisations understand usage patterns before risky habits disappear from view.

A diverse group actively collaborating in a bright, modern conference room setting.

Article | Articles

Human Risk Management Needs More Than Another Awareness Campaign

Human risk management works when safer choices fit pressure, pace and reality of everyday work.

Diverse team of call center agents working at computers in an office setting, focused on tasks.

Article | Articles

What Compliance Training Misses When It Only Measures Completion

Compliance training becomes meaningful when evidence shows behaviour shifting where cyber risk actually appears daily.

Article | Articles

AI Governance Is Not an IT Problem. It’s a Behaviour Problem

Governance strategies are being shaped with the expectation that if the right rules are in place, people will follow them....

A group of people working on their laptops and phone in an office

Article | Articles

The 3% Problem: Why Your Biggest AI Risk Is Already Inside Your Organisation

Every CISO we speak to is grappling with the same question right now: what are my people actually doing with...

Article | Articles

What Risks Do AI and Copilot Tools Create for Compliance?

The rapid rise of artificial intelligence tools is reshaping how organisations work and redefining workflows. But this transition is happening...

The back of a person's head who's coding on a computer

Article | Articles

A Hacker’s Perspective: Cyber Security Compliance and Human Risk

Glenn Wilkinson, ethical hacker and co-founder of Agger Labs: “A lot of organisations overestimate their position,” he explains. “They think...

A woman is sitting at her desk looking over documents. Her colleague is also sitting at his desk.

Article | Articles

What Do Auditors Look for in Effective Security Awareness Programs?

Most teams can point to activity: training delivered, policies acknowledged, completion rates logged and archived. The doubt tends to surface...

Article | Articles

Measuring What Matters in Cyber Security When Time and Resources Are Limited

Most cyber security teams operate under real constraints. The challenge isn’t collecting more cyber security data, it’s deciding which information...

Three people are sitting at a table and smiling

Article | Articles

Cyber Security Metrics That Show Behaviour Is Shifting

Security awareness is often measured by exposure, who completed training, who attended sessions, who passed a quiz. These signals show...

Someone working late night on their laptop

Article | Articles

Why Timing Matters in Security Awareness

Many security awareness programmes focus heavily on content, far less attention is paid to timing. Yet timing often determines whether...

A person is pointing at a laptop screen with charts and graphs on it.

Article | Articles

From Data Points to Decisions: What Makes a Cyber Security Metric Useful

The most useful question to ask of any security awareness metric is whether it helps someone make a better decision.

A busy table with staff sitting around it and many.

Article | Articles

The Behavioural Science Behind Human Risk (And Why Attackers Already Understand It)

People are expected to make decisions quickly, switch between tasks constantly, and respond to messages in real time. This environment...

Article | Articles

Does Your Team Need Cyber Awareness Training? Make Sure it Covers These 5 Things

You don’t need us to tell you that cyber threats are getting more sophisticated by the day (and perhaps even...

Article | Articles

Why is Security Awareness Training Important?

The frequency and variety of cyber threats are rising at an alarming rate. In the UK alone, over half of...

Animation of small person sitting on a laptop

Article | Articles

Mastering Timely Interventions and Nudge Theory

Timing is key for delivering any kind of security comms messages to your team. In the fast-moving world of cybersecurity,...

Article | Articles

How To Shape Your Security Identity

When we hear the word “identity” in the world of security, we may think of identity management. However, identity can...

Animation of two people. One person has question marks over their head.

Article | Articles

Strengthening Security Behaviours by Asking the Right Questions

When it comes to cyber security training, it’s easy to fall into the trap of information overload. Do you start...

Animation of two cartoon figures and a laptop

Article | Articles

What are the top 5 social engineering risks companies are facing in the UK?

Cybercriminals are getting smarter. Half of businesses, and around a third of charities, have experienced some form of cyber breach...

Animation of a mobile phone and emojis floating above

Article | Articles

Mastering The Art of Emotional Language

The cyber security industry has a problem. Everyone is scared of the subject, and a lot of it is our...

Article | Articles

What is the Most Common Form of Cyber Attack?

You don’t need us to tell you that cyber threats are getting more advanced, sophisticated and harder to identify in...

Article | Articles

Exploring The Transformative Power Of Simplified Language

This series will focus on the power of language and how using the right words can encourage positive behaviours, reduce...

Article | Articles

Fear and Silence: Half of Employees Afraid to Report Security Mistakes

Despite the increased adoption of security awareness training, our latest research reveals that more than half of cyber security professionals...

Animation of a person sitting on a laptop

Article | Articles

Timeline of Managing Communications in a Crisis

“When we asked our customers what they’d like to explore at our most recent meet up they shared that whilst...

Article | Articles

The time is now for a human-centric approach to cyber resilience in our Critical Industries

In an increasingly digitised world, Critical National infrastructures (CNI) stand as vital pillars supporting our modern way of life. However,...

Article | Articles

Healthcare at Risk: ICO and DBIR Data Analysis

Redflags reviewed data from the Information Commissioner’s Office (ICO) and the 2023 Data Breach Investigations Report (DBIR), suggesting the need...

A yellow door with cardboard boxes in front of it.

Article | Articles

How Redflags® approached holiday season scams in 2023

Black Friday, Cyber Monday, and the holiday season are some of the busiest periods for online shoppers. However, it’s also...

Article | Articles

Do You Wanna Be My Sugar Baby? A Tale of Cybersecurity Savvy

In the vast realm of cyberspace, a world filled with opportunities and pitfalls, one young woman’s story is a testament...

Animation of a magnifying glass and statistics and graphs and charts

Article | Articles

Measuring the success of phishing simulations, “positive” behaviour change

Most organisations now accept the need for a Security Awareness Training programme in some form or other. But what’s the...

Book cover of the psychology of persuasion

Article | Articles

How to persuade your people to act securely?

Wouldn’t it be great if you could significantly enhance the impact of your security awareness messaging with just a few...

Article | Articles

Too soon, too late, just right – Our Goldilocks theory of security awareness

We’ve previously introduced Kate as a typical employee being subjected to traditional security awareness training. After her training she goes...

Animation of woman sat staring at a laptop

Article | Articles

When work and security awareness collide… - Kate's Story

The NCSC recently set a “better engagement” challenge. Their view was that traditional security awareness wasn’t working to drive the...

Article | Articles

5 mistakes when tackling the human aspect of cyber security

Whilst there is increasing recognition that we need to tackle the human aspect of cyber security through training our people,...

Article | Articles

What is a Misdirected Email?

In this article, we explain the issue of misdirected emails, set out some example email data breaches and then highlight...

Article | Articles

How narrative-based learning can improve your awareness strategy?

If the last couple of years taught us anything, it was that things change, unexpected things happen. Any security practitioner...

Article | Articles

Science applied: how to motivate users to do security training

At Redflags, we are constantly exploring new approaches to delivering security awareness. In a project supported by Innovate UK. we...

A page with different mathematical equations

Article | Articles

Science applied: B=MAP - 3 steps to secure behaviour change

The Security Awareness market has existed in a recognisable form for about thirteen years now. Until very recently, however, solutions...

A white house with a grass lawn in front of it

Article | Articles

A CISO view: the security challenges of working from home

Large numbers of us have been required to get used to working from home (WFH) in 2020 and, as we...

The word 'responsibility' written in the clouds

Article | Articles

3 simple steps to improve your cyber security culture

The statement “security is everybody’s responsibility” is a common refrain. And it is an ideal end-state culture for many organisations....

Article | Articles

Do phishing simulations work?

It’s a commonly held belief that we learn from failure. But recent research has found the opposite: that failure can...

Coffee is being poured into a white mug that has the word 'ugh' written on it.

Article | Articles

6 ways to boost engagement in your security programme

…it’s little wonder some businesses end up with a cottage industry of line managers, HR and infosec staff chasing people...

A speedometer with the words 'engagement level' written on it

Article | Articles

What auditors want to see in your security awareness programme

Ask a security practitioner what they want from a security awareness programme, and the immediate response you receive will sometimes...

Article | Articles

6 changes you should make to your security awareness training

In part two of this series of blogs reporting on our research project to “Reimagine Security Awareness”, we feedback on...

Two yellow sticky notes side by side with drawings on them. One has a snoozing face and the other has a confused faced

Article | Articles

6 things users don’t like about their security awareness programme

Mention the phrase “mandatory training” to almost any employee and they will likely roll their eyes in despair. However, security...

A man on a stage addressing a large crowd of people

Article | Articles

Taking it to the people

In this article we explore why face-to-face sessions can be so effective. And look at how we can aim to...

Article | Articles

Simulated phishing: the speed cameras of security awareness

Over the last few years, phishing test and train solutions have become an increasingly common part of the security awareness...

Article | Articles

Nudging towards secure behaviour

How could a simple picture of a fly painted on a urinal make the bathrooms at Amsterdam’s Schipol airport 80%...

Articles

Educating Employees on Cyber Security with Active Measuring: A New Era of Cyber Awareness

When Phishing Simulations Stop Teaching

The Things People Hate Most About Cyber Security

Cyber Security Advice Fatigue: Why People Stop Listening

The Needle Needs to Move: Why AI Has Changed the Moment for Cyber Security

From knowing to doing: the case for Secure Behaviour Management

Why Secure Behaviour Management is becoming the channel’s next growth opportunity

If Employees Are the Human Firewall, What Are They Protecting?

Measure Twice, Cut Once: Why Cyber Security Needs a Baseline

Everything You Know About Nudges Is Wrong

Is AI bad for cyber security?

Has cyber security training outlived its usefulness?

Why Secure Behaviour Management isn’t just another cyber security buzzword

Security Culture Is Built in the Moments People Almost Miss

Nudge Theory Examples That Actually Belong in Cyber Security

What Is Human Risk Management, Really?

Social Engineering Has Changed, So Security Awareness Training Has To

Where Phishing Simulation Falls Short of Real-Time Behaviour Change

Why Visibility Should Come Before Control

The EAST Framework and the Case for Easier Secure Behaviour

What Data Breach Patterns Tell Us About Human Risk

Why Phishing Training Has to Catch Up with AI-Powered Attacks

Shadow AI Is a Visibility Problem Before It’s a Policy Problem

Human Risk Management Needs More Than Another Awareness Campaign

What Compliance Training Misses When It Only Measures Completion

AI Governance Is Not an IT Problem. It’s a Behaviour Problem

The 3% Problem: Why Your Biggest AI Risk Is Already Inside Your Organisation

What Risks Do AI and Copilot Tools Create for Compliance?

A Hacker’s Perspective: Cyber Security Compliance and Human Risk

What Do Auditors Look for in Effective Security Awareness Programs?

Measuring What Matters in Cyber Security When Time and Resources Are Limited

Cyber Security Metrics That Show Behaviour Is Shifting

Why Timing Matters in Security Awareness

From Data Points to Decisions: What Makes a Cyber Security Metric Useful

The Behavioural Science Behind Human Risk (And Why Attackers Already Understand It)

Does Your Team Need Cyber Awareness Training? Make Sure it Covers These 5 Things

Why is Security Awareness Training Important?

Mastering Timely Interventions and Nudge Theory

How To Shape Your Security Identity

Strengthening Security Behaviours by Asking the Right Questions

What are the top 5 social engineering risks companies are facing in the UK?

Mastering The Art of Emotional Language

What is the Most Common Form of Cyber Attack?

Exploring The Transformative Power Of Simplified Language

Fear and Silence: Half of Employees Afraid to Report Security Mistakes

Timeline of Managing Communications in a Crisis

The time is now for a human-centric approach to cyber resilience in our Critical Industries

Healthcare at Risk: ICO and DBIR Data Analysis

How Redflags® approached holiday season scams in 2023

Do You Wanna Be My Sugar Baby? A Tale of Cybersecurity Savvy

Measuring the success of phishing simulations, “positive” behaviour change

How to persuade your people to act securely?

Too soon, too late, just right – Our Goldilocks theory of security awareness

When work and security awareness collide… - Kate's Story

5 mistakes when tackling the human aspect of cyber security

What is a Misdirected Email?

How narrative-based learning can improve your awareness strategy?

Science applied: how to motivate users to do security training

Science applied: B=MAP - 3 steps to secure behaviour change

A CISO view: the security challenges of working from home

3 simple steps to improve your cyber security culture

Do phishing simulations work?

6 ways to boost engagement in your security programme

What auditors want to see in your security awareness programme

6 changes you should make to your security awareness training

6 things users don’t like about their security awareness programme

Taking it to the people

Simulated phishing: the speed cameras of security awareness

Nudging towards secure behaviour