Hacking people and organizations for greater good

The talk argues that culture forms in every group whether or not anyone plans it, and that it can be guided on purpose. To illustrate, the speakers recall a military squad whose strong team identity came from a shared goal, individual incentives and clearly split responsibilities. They describe culture in layers: visible artifacts such as documents, org charts and dress codes, then stated values, and finally unspoken assumptions, which are the hardest to change but last the longest.

The middle section covers common ways security efforts fail. Typical examples include a gap between strategy and daily practice, copying solutions without tailoring them to the context, weak communication, and bringing security in too late, after a project has already moved in the wrong direction. The speakers walk through a set of questions for practitioners: why the program exists, who owns decisions and holds the budget, what "done" and "secure enough" mean, and how tightly the work should be scoped. They suggest that a change in leadership can open a window for new initiatives, and that honest audits and early involvement in planning help security teams gain visibility.

The closing points stress building support from higher management, staying active and collaborative rather than only pointing out faults, and offering solutions alongside findings. The session ends with thanks to the volunteers who run the event and a request for attendees to take their trash with them.