The Awareness Practitioners

Where does a security awareness career actually go? I went looking, and I did not like what I found.

Salaries flatten early. The senior seats barely exist outside the biggest companies. The job market does not even track security awareness as its own discipline. But it does track something else, and the skills listed next to it are the exact things practitioners do every day.

In this episode I pull apart a typical awareness CV line by line and rewrite it in the language of security enablement. Same work, same wins, and it reads like a completely different career. Then the bigger questions. Should we rename the roles? Should we rename the discipline? And was it ever the cyber, or was it always the enablement?

The Awareness Practitioners is a podcast for the people making security human. No vendor pitches. No theory without application. Just honest conversations about changing behaviour and building security cultures that actually work.

Also from Risky Creative: The Awareness Angle, weekly cybersecurity news made for humans, not just IT teams.
Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6
Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196

Check out the Secure Culture Hub.
https://www.secureculture.com

Follow Ant:
LinkedIn: https://www.linkedin.com/in/antdaviscyber
TikTok: https://www.tiktok.com/@antdaviscyber
Instagram: https://www.instagram.com/antdaviscyber
Website: https://antdavis.com

Theme music: "X" by falling forever (fallingforever.bandcamp.com/track/x-2). Licensed CC BY 4.0. creativecommons.org/licenses/by/4.0/

Ahead of the SANS Security Awareness and Culture Summit at Caesars Palace, I sat down with Rachael, global PMM and head of marketing for SANS Digital, to find out what's actually waiting for you there. We talk about the keynote on espionage, trust and the people around you, what it's like when three hundred and fifty security awareness professionals fill one room, and why Rachael reckons this corner of cyber security is the least soft and fluffy part of the industry, not the most.

If you're on the fence about going, or watching from home this year, this one's for you. Use code risky_summit_pass for 25% off your Summit pass.

The Awareness Practitioners is a podcast for the people making security human. No vendor pitches. No theory without application. Just honest conversations about changing behaviour and building security cultures that actually work.Listen on Spotify and Apple Podcasts. New episodes every week.Also from Risky Creative: The Awareness Angle, weekly cybersecurity news made for humans, not just IT teams.Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196Newsletter: https://www.linkedin.com/newsletters/the-awareness-angle-newsletter-7274932363787132928/Check out the Secure Culture Hub. A home for people working on the human side of cybersecurity.https://www.secureculture.comFollow Ant:LinkedIn: https://www.linkedin.com/in/antdaviscyberTikTok: https://www.tiktok.com/@antdaviscyberInstagram: https://www.instagram.com/antdaviscyberWebsite: https://antdavis.comRisky Creative: https://www.riskycreative.comAnt's site : https://www.antdavis.comTheme music: "X" by falling forever (fallingforever.bandcamp.com/track/x-2). Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). creativecommons.org/licenses/by/4.0/

#SecurityAwareness #CyberSecurity #SecurityCulture #HumanRisk #BehaviourChange

Your awareness programme might have a brand. It might not. But what if people actually talked about it?

In this episode I look at what Octopus Energy did in a low-interest category that everyone hated, and why it maps directly onto the security awareness problem. We cover the von Restorff effect, the visual and tonal dialect that awareness programmes have built collectively over years, and what genuine distinctiveness looks like in practice.

I also introduce you to someone who has been doing this longer than some of the employees she was built to reach.

Referenced: Nudge podcast with Phil Agnew, episode What Makes a Good Logo.
https://www.nudgepodcast.com/podcast/episode/258a1c0a/what-makes-a-good-logo

Also from Risky Creative: The Awareness Angle, weekly cybersecurity news made for humans, not just IT teams.
Spotify: https://open.spotify.com/show/7rwzcRsKrXbASFBfiXoCZ6
Apple Podcasts: https://podcasts.apple.com/us/podcast/the-awareness-angle-cyber-news-weekly/id1784126196

Check out the Secure Culture Hub.
https://www.secureculture.com

Follow Ant:
LinkedIn: https://www.linkedin.com/in/antdaviscyber
TikTok: https://www.tiktok.com/@antdaviscyber
Instagram: https://www.instagram.com/antdaviscyber
Website: https://antdavis.com

Theme music: "X" by falling forever (fallingforever.bandcamp.com/track/x-2). Licensed CC BY 4.0. creativecommons.org/licenses/by/4.0/

You can have the data, the evidence, the results. And still watch it change nothing.

In 1847, Ignaz Semmelweis worked out why mothers were dying in a Vienna maternity ward. He proved it. He cut the death rate to almost zero. And the medical establishment turned its back on him. He was right about everything, and he still lost.

This episode is about why being right is the start of the job, not the end of it. We look at the resistance Semmelweis faced, the mistakes he made in how he fought it, and what every security awareness and culture professional can take from it when the evidence is on your side but nobody will move.

If you have ever sat in a room with a clear finding and watched someone senior look away, this one is for you.

The Awareness Practitioners is the podcast for the people making security human. No vendor fluff. No scare tactics. Just real conversations for the people doing the work.

New episodes every Thursday. Hosted by Anthony at Risky Creative.

Theme music: "X" by falling forever, available at Bandcamp. Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

Nobody runs out of their house to thank a traffic warden. They are walking down the street doing a job most people would actually agree with, but every single interaction they have lands at the worst moment of somebody's week. Sound familiar?In this episode of The Awareness Practitioners, Ant looks at the perception of security teams and the uncomfortable truth that most of us have never sat down and asked what we are actually broadcasting. Perception is not something that happens to your team. It is something your team creates, every day, through every email, every blocked request, and every demand.This one is about auditing the pattern, not designing another campaign. You will leave with a practical Monday morning exercise that costs nothing, needs no budget, and does not require leadership buy-in.00:00 The traffic warden problem07:38 The three bucket audit10:21 Is your perception earned?13:11 The sent items exerciseThe Awareness Practitioners is the show for the people making security human.Got thoughts, or did this one make you uncomfortable? Find Ant on LinkedIn and tell him what you found in your sent items.Listen on Spotify and Apple Podcasts. New episodes every Thursday.

Nearly a thousand people were using a tool that legal wanted to block. Instead of blocking it, we asked why they were all using it in the first place. That question changed everything.

In this episode, I take a concept from urban planning called desire paths and apply it to security awareness. A desire path is the shortcut worn into the grass where people ignore the official route and walk where it actually makes sense. Your organisation is full of them. Every workaround, every unsanctioned tool, every file emailed instead of uploaded to the portal.

Most organisations respond by blocking the shortcut. The research says that makes things worse. So what should practitioners do instead? Watch where people are actually walking.

Oli Inkley started on the Waitrose shop floor. Four and a half years later, he's starting a new adventure in security awareness and culture at Marks and Spencer.In this episode, Oli talks about how he went from managing retail teams and night shifts to building champions programmes, learning to speak the language of engineers, and figuring out what actually works when every organisation does security differently.We cover:

• Why his retail background turned out to be his biggest asset
• What surprised him most moving from frontline operations to corporate security
• How he learned to have technical conversations without a technical background
• Building champions programmes at Ocado, Tesco, and now M&S
• Why three similar retailers need completely different approaches
• What he'd do first if he was starting from scratch at a new organisation
• Where AI fits in this space and where it doesn't

If you're working in security awareness, thinking about moving into it, or wondering whether you need a technical background to do it well, this one's worth your time.

World Password Day doesn't work. Most of us in security awareness know that. But that doesn't mean you should stop using it.

In this episode I break down where World Password Day actually came from, why it became one of the most recognised awareness dates in cybersecurity, and why the advice most people share on it is now outdated. I also tell you the story of Grandparents Day and what it teaches us about why visibility beats purity every single time.

If you are an awareness practitioner, this one is for you. The day is the door. What you walk through it with is up to you.

Subscribe so you don't miss the next one.

Also from Risky Creative: The Awareness Angle. Weekly conversations with the people shaping security awareness, human risk, and behaviour change. Guests from across the industry every Monday.

Theme music: "X" by falling forever. Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

A Risky Creative production.