Nearly a thousand people were using a tool that legal wanted to block. Instead of blocking it, we asked why they were all using it in the first place. That question changed everything.

In this episode, I take a concept from urban planning called desire paths and apply it to security awareness. A desire path is the shortcut worn into the grass where people ignore the official route and walk where it actually makes sense. Your organisation is full of them. Every workaround, every unsanctioned tool, every file emailed instead of uploaded to the portal.

Most organisations respond by blocking the shortcut. The research says that makes things worse. So what should practitioners do instead? Watch where people are actually walking.

Oli Inkley started on the Waitrose shop floor. Four and a half years later, he's starting a new adventure in security awareness and culture at Marks and Spencer.In this episode, Oli talks about how he went from managing retail teams and night shifts to building champions programmes, learning to speak the language of engineers, and figuring out what actually works when every organisation does security differently.We cover:

• Why his retail background turned out to be his biggest asset
• What surprised him most moving from frontline operations to corporate security
• How he learned to have technical conversations without a technical background
• Building champions programmes at Ocado, Tesco, and now M&S
• Why three similar retailers need completely different approaches
• What he'd do first if he was starting from scratch at a new organisation
• Where AI fits in this space and where it doesn't

If you're working in security awareness, thinking about moving into it, or wondering whether you need a technical background to do it well, this one's worth your time.

World Password Day doesn't work. Most of us in security awareness know that. But that doesn't mean you should stop using it.

In this episode I break down where World Password Day actually came from, why it became one of the most recognised awareness dates in cybersecurity, and why the advice most people share on it is now outdated. I also tell you the story of Grandparents Day and what it teaches us about why visibility beats purity every single time.

If you are an awareness practitioner, this one is for you. The day is the door. What you walk through it with is up to you.

Subscribe so you don't miss the next one.

Also from Risky Creative: The Awareness Angle. Weekly conversations with the people shaping security awareness, human risk, and behaviour change. Guests from across the industry every Monday.

Theme music: "X" by falling forever. Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

A Risky Creative production.