Diana Initiative 2025-Aaron Stanely-Click Here Now: A Positive Way to Create Phishing Awareness

## The Problem with Shame

Aaron Stanley opens with a provocative claim: most phishing awareness programs fail because they punish users. Citing Brené Brown, he describes how shame convinces people they cannot change, undermining the security culture organizations claim they want.

## A Better Model

Stanley contrasts annual slide decks and gotcha simulations with positive, repeated practice—like California schools drilling earthquake response until behavior becomes instinct. Security training should build confidence and reflexes, not fear of HR consequences.

## Click Here Now

His team runs simulations that reward engagement and teach recognition without humiliation. The approach treats phishing defense as a skill developed over time, similar to emergency preparedness, rather than a compliance checkbox.

## Culture Over Blame

The talk urges security teams to stop treating users as the weakest link and start designing programs people actually want to participate in. Positive reinforcement, he argues, produces lasting behavior change that punitive campaigns never achieve.