TL;DR SUMMARY: Knowing what to do doesn’t always mean doing it. Secure Behaviour Management focuses on the moments when security decisions happen, using context, timely interventions and behavioural insight to support better decisions and measure what changes.
The moment has changed
Cyber security has spent years asking people to remember more. Remember the warning signs, remember the policy, remember the training and remember what to do when something looks suspicious. There was good reason for that approach. When working environments were more predictable and the signs of a malicious message were easier to recognise, building knowledge and reinforcing it over time could take people a long way.
The ground has shifted. People now work across cloud platforms, collaboration tools, mobile devices and generative AI services, moving between them with barely a pause. At the same time, attackers have access to technology that can produce convincing, targeted social engineering at a scale that would’ve been difficult to imagine only a few years ago.
ENISA’s 2025 Threat Landscape gives a useful measure of that change. Its analysis covers 4,875 incidents observed between July 2024 and June 2025, with phishing accounting for about 60% of observed initial intrusion vectors. The report also identifies the growing use of AI to enhance malicious activity, including phishing and automated social engineering. (enisa.europa.eu)
The significance sits in what happens around those numbers. People are making more security decisions in increasingly complex digital environments, while those trying to deceive them have more sophisticated means of shaping the interaction.
A person can understand phishing perfectly well and still follow a convincing link. They can know that sensitive information shouldn’t be entered into an AI service and still do it when the information appears harmless, the task is urgent and the tool is already open in another tab. Knowledge matters, yet the context in which a decision is made can matter just as much.
That makes the moment of decision increasingly important.
AI has shortened the distance between persuasion and action
For years, security awareness could rely on a familiar catalogue of warning signs. Poor spelling, strange phrasing, an unfamiliar sender, an attachment that seemed out of place or a link that looked suspicious all provided useful clues. Those signals still have value, although they’re less dependable when malicious interactions become harder to distinguish from ordinary work.
AI is helping to close that gap. Language can be polished, messages can be tailored and social engineering can be produced at greater speed and scale. ENISA’s research describes large language models being used to enhance phishing and automate social engineering, while also identifying AI systems themselves as an emerging area of exposure. (enisa.europa.eu)
A malicious request might arrive from someone whose name is familiar, relate to a project the recipient is actually working on and appear during a busy afternoon when it feels like one more routine task to clear from the list.
Modern work rewards that instinct to keep things moving. People scan, respond, switch between applications and make dozens of small judgements without consciously analysing each one. That’s part of what makes digital work productive, yet it’s also the rhythm in which social engineering can find its opening.
The question for security leaders is how to support better decisions within that pace of work.
The case for moving the needle
ENISA’s NIS Investments 2025 study shows where organisations are putting their attention. The research surveyed 1,080 professionals across organisations in EU Member States and sectors of high criticality under NIS2. Looking ahead, 47% identified implementing or upgrading cybersecurity technology and tools as an expected outcome of investment, while 34% cited improving cyber resilience and 33% improving organisational cybersecurity awareness and training. (enisa.europa.eu)
Technology remains fundamental to that picture. Detection, identity controls, endpoint protection, vulnerability management, monitoring and response all have an essential role. The more interesting question is what happens when those capabilities meet the person making a decision.
Awareness has traditionally lived slightly apart from the working day. There’s a course to complete, a campaign to launch, a simulation to run and a policy to circulate. Those activities can build knowledge, yet the decision that matters often arrives much later, when someone is busy, distracted or simply trying to finish a task.
Contextual security brings the intervention closer to that decision. Someone about to click a link can receive useful guidance while the link is still in front of them. Someone preparing to upload information can be reminded of what they’re about to share. Someone interacting with an unfamiliar AI service can be given relevant context before information leaves the organisation.
The intervention can be brief and proportionate. It doesn’t need to pull someone out of their workflow or turn an everyday action into a security exercise. Its value comes from arriving while the circumstances are still fresh.
From System 1 to System 2, at the right moment
Daniel Kahneman’s distinction between fast, intuitive System 1 thinking and slower, more deliberate System 2 thinking offers a useful lens for understanding the challenge. Most modern work depends on System 1. People scan, sort, respond and move on, allowing familiar actions to become almost frictionless.
Security can’t reasonably ask people to scrutinise every interaction. The cost would be enormous, both in time and attention, and much of the speed that makes modern work possible would disappear.
There are moments, though, when a small amount of deliberate thought can change the outcome. A well-timed intervention can create that pause without requiring a wholesale change in behaviour. The person remains in control of the decision, while having a little more information available at the point where it can make a difference.
This is where behavioural security becomes particularly relevant. Security can sit alongside the action rather than waiting somewhere in the background to be remembered.
Redflags takes this approach through contextual security nudges, behavioural measurement and targeted interventions within everyday workflows. The aim is to give people useful information when they can act on it, while giving security teams greater visibility into how behaviour changes over time.
The person already knows what they’re doing, why they’re doing it and what they’re trying to achieve. Security can meet them in that moment rather than asking them to step away from the task and enter a separate learning environment.
AI makes this shift more urgent
Generative AI has brought the issue into sharper focus because it has made the movement of information almost effortless. Someone can take material from an internal document, paste it into an AI service and receive a useful response within seconds. They can experiment with a new tool during the course of their work, or use AI to summarise, rewrite and analyse information without necessarily stopping to consider what travels with the request.
The security decision can happen almost invisibly. Is the information appropriate to share? Is the service approved? Does the prompt contain commercially sensitive material? Has something been exposed that was never intended to leave the organisation?
These decisions are being made at keyboards, in browsers and inside the applications people use every day. As AI helps attackers create more convincing interactions, some of the visual and linguistic cues people have traditionally relied upon become harder to trust.
People aren’t simply the final link in a chain of technical controls. They’re interpreting requests, navigating ambiguity and deciding what to do with information throughout the working day. That makes behaviour a meaningful part of the security environment, particularly as AI changes both the tools people use and the ways attackers can manipulate them.
The shift from awareness to behaviour
The ambition shouldn’t be to turn every employee into a cyber security expert. It should be to make secure behaviour easier when circumstances demand it, while allowing people to get on with their jobs.
Learning still matters, as do policies, simulations and formal training, yet their value increases when they’re connected to what people actually do. If a particular behaviour creates risk, there’s an opportunity to address it where and when it occurs.
That also gives security teams better questions to ask. Training completion tells them whether someone has finished a programme. Behavioural signals can tell them more about what happens afterwards. Patterns around risky interactions can reveal where people need additional support, where interventions are working and where a particular type of behaviour continues to create exposure.
Over time, that can build a richer picture of human risk. Learning becomes part of the working environment rather than something that sits outside it, waiting for the next training cycle.
The needle needs to move now
There’s a particular opportunity in the current moment. AI is already forcing organisations to reconsider information, access, governance and risk, while the threat environment is placing greater pressure on the decisions people make inside those systems.
Security teams have spent years building layers around the user. Firewalls, endpoint controls, identity systems, email security, monitoring and detection all play their part. Human behaviour has often been addressed through a separate layer of awareness and training.
That layer can become more responsive. Security can recognise when a decision carries greater risk and introduce the right amount of friction at that point. A prompt can encourage someone to look again, while context can make an invisible risk visible. A small interruption can create enough space for a better decision without derailing the task itself.
For organisations adopting AI at speed, that becomes particularly valuable. The technology is moving faster than many policies, habits and assumptions can comfortably keep pace with. Security has an opportunity to move with it by becoming part of the decisions people are already making.
Consider the link that looks familiar enough to click, the document that seems harmless enough to upload, the request that feels routine enough to answer or the AI prompt that saves five minutes while quietly raising a question about where the information is going. These moments pass quickly, so the value of intervention lies in reaching them before the decision has been made.
The needle needs to move because the environment has changed. People are working faster across more connected systems, while AI is making both legitimate work and malicious activity easier to produce at scale.
The response can be practical. Move security closer to the point of action. Give people useful context while it can still influence what they do. Use behaviour as a source of insight. Create deliberate pauses where they’re most valuable, without turning every interaction into an obstacle.
The most effective intervention may barely interrupt the flow of work. It might simply give someone a reason to look again, check the context or consider what they’re about to do.
Sometimes that small shift is where safer behaviour begins.
Key takeaways
-
AI is changing the human risk equation. ENISA’s 2025 research identifies the growing use of AI to enhance phishing and automate social engineering. (enisa.europa.eu)
-
Phishing remains a major route into organisations. ENISA found phishing accounted for about 60% of observed initial intrusion vectors in its 2025 Threat Landscape. (enisa.europa.eu)
-
Technology remains a major investment priority. ENISA found 47% of surveyed organisations expected investment to focus on implementing or upgrading cybersecurity technology and tools, while 33% identified organisational awareness and training. (enisa.europa.eu)
-
Timing matters. Security guidance can have greater practical value when it appears alongside the action that creates the risk.
-
Behaviour offers another source of security intelligence. Looking at what people do can reveal patterns that training completion alone can’t show.
-
AI adoption creates an immediate opportunity. As organisations rethink how information moves through AI tools, contextual security can bring safer decision-making into the workflow.
-
Small interventions can create useful moments of reflection. Targeted nudges can support better decisions without turning everyday work into a sequence of security checks.
-
The human layer can become more adaptive. Behavioural measurement, contextual guidance and targeted interventions can connect security awareness more closely with the realities of modern work.
