TL;DR SUMMARY: Knowing what to do doesn’t always mean doing it. Secure Behaviour Management focuses on the moments when security decisions happen, using context, timely interventions and behavioural insight to support better decisions and measure what changes.
Where secure behaviour actually happens
Much of cyber security education is designed around preparing people for situations they might encounter. People learn how phishing works, complete awareness training, read policies and practise recognising suspicious messages. Those activities have an important role, particularly when they give people a useful mental model for recognising and responding to risk.
The more difficult question comes when knowledge meets a real situation. Someone might be working quickly to meet a deadline when an email arrives that appears to come from a familiar contact. They understand that unexpected links deserve scrutiny, yet the message looks plausible, the request seems routine and several other things are competing for their attention. A decision that looks straightforward in hindsight can feel very different when made in a few seconds, under pressure and in the middle of something else.
If knowledge is only one influence on behaviour, understanding the circumstances surrounding a decision becomes just as important as understanding what someone knows.
This is where Secure Behaviour Management offers a useful way of thinking about security. Instead of considering behaviour primarily as an expression of knowledge or compliance, the approach looks at the conditions in which decisions are made. What is the person trying to achieve? What information do they have available? How much effort does the secure option require? What might make one course of action feel easier, faster or more natural than another?
The shift is important. The goal isn’t simply to give people more security information, but to understand what happens when that information meets the reality of work, then create conditions that support better decisions.
Behaviour is shaped by context
A person can know that phishing presents a risk and still interact with a convincing message. They can understand the importance of careful data handling and choose the quickest available route when a process is creating friction. Someone can know that reporting a mistake is encouraged and hesitate to do so if previous experiences have made admitting an error uncomfortable.
People don’t always make decisions by carefully weighing every available option. Attention, workload, time pressure, familiarity and the perceived effort involved can all influence what feels like the most natural course of action. Security teams therefore need to consider not only whether a behaviour is risky, but what might be making that behaviour more likely.
The NCSC takes a similar perspective in its guidance on cyber security culture, encouraging organisations to understand the reasons behind behaviour and the ways workplace pressures, processes and systems can influence the choices people make. Its phishing guidance also warns against treating users as the weak link, noting that people click for a range of reasons, including situational factors such as being busy or stressed.
For security teams, this creates a broader set of questions. Is the secure action clear and practical? Does the person have enough information at the point of decision? Is there a conflict between what security expects and what their role is asking them to achieve? Could a process, system or workplace pressure be creating the conditions for the behaviour?
A recurring shortcut might indicate a gap in knowledge, although it could equally point towards an awkward process, competing incentives, unnecessary friction or a situation where the secure option is simply harder to take.
The same principle applies to mistakes. Treating every instance of insecure behaviour as individual failure can obscure the conditions that produced it, while making people less inclined to admit when something has gone wrong. A positive security culture can give people more confidence to ask for help and report mistakes, giving security teams a clearer view of where risk is actually occurring.
Behavioural science brings the decision into focus
Behavioural science provides useful ways to understand the small factors influencing what people notice, how they interpret a situation and which action they ultimately take. One of the most familiar concepts is the nudge, where aspects of the environment around a decision are designed to make a particular behaviour easier, more visible or more likely. The individual remains free to choose; the surrounding conditions have been shaped to support that choice.
This is often described as choice architecture. The idea isn’t simply to tell someone what they should do, but to consider how the environment around a decision can make the desired behaviour easier to recognise and act upon.
In cyber security, the principle can be remarkably simple. A prompt might encourage someone to pause before interacting with an unusual message. Contextual information could help them recognise why a request deserves further scrutiny, while a clear route to seek help might remove the hesitation that otherwise leads someone to make a decision alone.
Not every intervention needs to correct a mistake. Sometimes the most useful support is a small boost in confidence, helping someone who already has the right instinct to trust it and act on it.
Frameworks such as BJ Fogg’s Behaviour Model, EAST and MINDSPACE offer different ways of thinking about these influences, with common threads around capability, context, attention, motivation and the design of choices. For security teams, behavioural science provides a bridge between understanding why people behave as they do and designing practical interventions around those behaviours.
A more connected view of human risk
As organisations become more technologically sophisticated, human behaviour remains closely connected to the way security works in practice. AI, cloud services, distributed working and increasingly connected environments are creating new situations in which people have to make security decisions, often quickly and within the flow of their normal work.
Training still has a role in establishing knowledge and expectations, while policies define boundaries and technical controls reduce the opportunities for certain types of risk. Behavioural insight adds another layer, showing how those measures are working when they meet the reality of everyday activity.
For channel partners, that can open up a more useful line of questioning. How are people actually interacting with the technologies an organisation has invested in? Where are secure processes becoming difficult to follow? Which behaviours are changing, and which appear to be more persistent? What does the evidence suggest should happen next?
“Customers don’t necessarily need another conversation about whether they’ve got enough security technology,” says Craig Marshall-Brown, Head of Channel at Redflags. “They need help understanding how their security works in practice, including where people are making decisions, where those decisions are creating risk and what can be done about it.”
Those conversations can bring behavioural evidence into the same space as technology, governance and operational priorities, helping customers understand where human risk is appearing and how it changes over time.
For the channel, the longer-term shift is towards becoming increasingly useful between technology purchases, bringing interpretation and context into the relationship as customers’ people, technology and working practices continue to evolve. Secure Behaviour Management forms part of that evolution, connecting the systems organisations deploy with the human decisions that ultimately determine how securely those systems are used.
Timing can change the value of an intervention
Security has traditionally been good at giving people information before they need it. People need a foundation of knowledge before they can recognise and respond to many forms of risk, yet there’s an opportunity to connect that foundation with the moments when security decisions actually happen.
A reminder about suspicious links delivered weeks before someone encounters one has a different role from a short prompt appearing at the moment they’re about to interact with a potentially risky message. The latter can create a small amount of space between an initial reaction and the action that follows, bringing the relevant risk back into focus while there’s still an opportunity to reconsider.
This takes the idea of the nudge to its logical conclusion. Instead of asking people to remember a lesson at some point in the future, a real-time nudge can act as a digital tap on the shoulder, appearing when the circumstances make it useful.
When it’s brief, relevant and connected to what’s happening, the intervention can become part of the working environment rather than another separate training exercise.
Redflags takes this contextual approach to secure behaviour, using behavioural nudges to support people at the point where security-relevant decisions occur. The person remains at the centre of the interaction, with the intervention providing an opportunity to recognise what’s happening, consider the potential risk and decide how to proceed.
From training events to continuous learning
People don’t encounter security as an annual event. They encounter it while using new systems, changing roles, handling unfamiliar requests, working under pressure and adapting to new ways of doing their jobs. Behaviour develops through those experiences, which makes continuous learning more useful than treating awareness as something that happens at a fixed point in the calendar.
Training can establish knowledge and expectations, while smaller interventions, feedback and opportunities to practise can help people apply those foundations as circumstances change.
The distinction matters because regulatory and governance expectations don’t necessarily translate into a requirement for a particular training format. The UK’s Cyber Governance Code of Practice, for example, calls for an effective cyber security training, education and awareness programme supported by suitable metrics. Its annual exercising requirement relates to incident planning and response, not an annual phishing training exercise.
The NCSC’s phishing guidance also cautions that no training package, including phishing simulations, can teach people to spot every phishing attempt. It recommends a broader, multi-layered approach and highlights the importance of positive reporting cultures.
The question isn’t how often people have been trained, but whether the organisation is creating the conditions for secure behaviour to develop and persist.
A continuous approach can be thought of as a cycle:
- Understand: identify the behaviour and the context surrounding it.
- Baseline: establish what the behaviour looks like before intervention.
- Intervene: provide support that fits the situation and the decision being made.
- Measure: observe what changes and whether the change persists.
- Adapt: use what’s been learned to refine the next intervention.
Continuous learning isn’t simply about delivering more content more frequently. It’s about creating opportunities for people to encounter, practise and reinforce secure behaviour as part of the work they’re already doing.
Measure what changes
Once behaviour becomes part of the security conversation, measurement needs to follow. Counting completed training modules or participation in simulations tells an organisation something about activity, while behaviour-focused measures can provide insight into whether an intervention is having the intended effect.
The starting point is a baseline. What does the behaviour look like before an intervention? How often does it occur, and in which circumstances? What happens when support is introduced? Does the response change, and does that change persist?
The measures will depend on the behaviour being addressed. They might relate to reporting, interaction with suspicious content, responses to particular workflows, use of secure processes or other observable actions. The important part is establishing a meaningful connection between the intervention and the outcome being measured.
Good measurement also leaves room for the unexpected. An intervention may improve one behaviour while revealing friction elsewhere, or show that a problem attributed to awareness actually has its roots in a process or system. Evidence of that kind can tell the organisation where its understanding needs to develop.
The UK’s Cyber Governance Code of Practice similarly calls for suitable metrics to provide assurance that training, education and awareness programmes are effective.
For SBM, measurement isn’t an afterthought. Baseline and impact help turn behavioural intervention into an evidence-led process, giving security teams a way to understand what works, where friction remains and what should happen next.
What Secure Behaviour Management looks like in practice
Taken together, these ideas form a continuous cycle of understanding, intervention and learning. Understanding without intervention leaves useful insight sitting on the page, while intervention without measurement makes it difficult to know whether anything changed. Measurement without context can turn behaviour into a collection of numbers without explaining what sits behind them.
Secure Behaviour Management brings those elements together around the moments where people actually make security decisions.
Training can build knowledge, policies can establish expectations and technical controls can create boundaries. Behavioural interventions add support where those layers meet a real decision in the flow of work, while measurement shows where the approach is helping and where further attention is needed.
For Redflags, this means putting behavioural insight into the working environment itself. A contextual nudge can support someone at the point of risk, while the resulting behavioural data can help security teams understand what happened and where further support could be useful.
The broader shift is from asking whether people have received enough security information to asking whether the environment gives them a realistic opportunity to use it.
When secure behaviour becomes difficult, the difficulty itself can be useful evidence. It may point towards a knowledge gap, but it may also expose friction in a process, pressure within a role or an intervention that isn’t arriving at the right moment.
That makes behaviour more than an outcome to monitor. It becomes a source of insight that can help security teams improve the conditions in which secure decisions are made.
Key takeaways
-
Find the friction, not just the failure. Risky behaviour can reveal weaknesses in processes, technology and working practices.
-
Put support where decisions happen. A timely nudge can turn existing security knowledge into a better decision at the point of risk.
-
Measure impact, not just activity. Baselines and behavioural data can show whether an intervention is actually changing what people do.
-
Treat behaviour as security intelligence. What people do, when they struggle and how they respond can reveal where the wider security environment needs to improve.
