Strengthening Security Culture Through Compassion and Understanding

Davis, a security compliance engineer at amazee.io, argues that people are often the weakest link in a security program and that annual awareness training alone does not change behavior. He explains how a punitive environment leads staff to hide mistakes, skip incident reports, and see security as an opponent. He breaks fear into several forms, such as fear of punishment, blame, judgment, and uncertainty, and ties each one to costs like delayed reporting and lost trust.

The core of the talk is compassion as a practical approach: empathy, patience, a non-judgmental stance, and encouragement for people who report problems. Examples include treating a first error as an honest accident, thanking staff who flag phishing emails, sending short monthly security briefings, and having leaders follow the same rules. He points to Google's move to hardware security keys, Netscape's early bug bounty, and Microsoft's secure development lifecycle as cases where fixing root causes worked better than blaming people.

He closes by arguing that rewarding early reporting and treating mistakes as lessons leads to earlier detection and fewer successful attacks. Audience questions covered motivational coaching, linking work security habits to personal life, and using gamification to engage staff.