A Hacker's Guide to People-Patching in 90 Days

The talk reframes the familiar idea that humans are the weakest link, arguing that human behavior follows predictable biology and can be strengthened instead of blamed. The speaker draws on a dataset from more than 1,300 organizations that combines training results, phishing simulation outcomes, real reporting data and survey answers. One finding is that the likelihood of a click climbs with time since training, which suggests short, regular interventions beat a single annual session.

Much of the middle focuses on why people click. In a survey of people who had clicked simulated lures, mimicry, where messages looked legitimate or matched something expected, was the most common explanation, while fear was rare. The talk covers optimism bias, overconfidence after brief training, and higher click rates among those who fully trust security tools. It also argues that long post-click education pages fail because people rarely stay long enough to read them, and that system one thinking and cognitive load explain many errors.

The closing section turns to practical design using a neuroscience-based model covering status, certainty, autonomy, relatedness and fairness. Suggested tactics include visible progress scores, winnable and fair simulations, rewards for reporting even after a click, and positive recognition in place of shame boards. Executives should be shown post-click report rates and reporter accuracy, not click rates alone. The takeaway is that people-focused programs work best as continuous, motivational loops.