No more speedruns: Better security training (with what you have)

Susanna Haavisto argues that many security awareness programs are designed to satisfy compliance rather than to teach, so employees rush through them the way speedrunners rush through games. She links this to human risk, noting that social engineering exploits everyday emotions and that the people running training often handle it alongside other duties with little budget.

The core of the talk is a model of behavior change: people need the ability to act, the motivation to do so, and a trigger that prompts the action. Haavisto suggests tailoring material to each role and to personal life, using real incidents, including an organization's own breach told without blame, and asking staff what they worry about or are curious about to build ownership. She also recommends having team members teach concepts to one another and recognizing people who report suspicious messages.

For scheduling, she proposes replacing long annual sessions with a steady drip of two- to three-minute microtrainings, roughly thirty or more a year, timed to relevant seasons. Her example takes a one-hour password module and splits it into a simulation, a short lesson, a chat tip and a small reward for reporting. The takeaway is to put people at the center of training design and keep material short and recurring.