Human Security Spaghetti & the Wall you're Throwing it at

The talk opens with the gap between knowing what to do and actually changing behavior. Using a personal weight-loss example, the speaker walks through a six-stage model of change and argues that raising awareness covers only a small part of the work. Treating awareness as most of the job, the speaker says, overlooks the sustained effort that lasting change requires.

The middle section describes a behavioral engineering program aimed at credential capture, a technique red teams rely on heavily. Working with the red and blue teams, the team chose a concrete goal: employees should report emails that send them to login pages. The blue team agreed that more reports were worth the extra noise, and comms teams added an anti-phishing footer for verification. On the technology side, the team used email filtering, external tagging and a corporate password manager whose autofill would fail on spoofed domains. On the human side, per-organization dashboards created passive and active competition, a "knighthood" with swag rewarded top performers, executives sent monthly messages, and Slack nudges reminded people when they typed risky words.

Over two years the reported results were a halved credential capture rate, a tenfold drop in susceptibility, more than doubled reporting and a tripled password manager adoption rate. The takeaways were to research the audience, partner with teams that already run behavior programs, point out behaviors as early as possible and adopt a password manager. In the Q&A, the speaker said that two-factor adoption would be the next focus.