"People need to know you exist. If they're gonna scroll past the email, everything else is a waste of effort."

Marketing has spent a hundred years working out how to change what people do. Security has spent twenty years telling people what to do. Owen Sutton has never worked in cyber security, and that's exactly why we handed him the awareness campaign as a brief.

Owen spent 21 years at BT, finishing as head of brand management and design, where he ran the in-house design team. Before that, portfolio marketing in BT Global Services, plus stints in bid management and global operations. He now runs Quietwork, building AI automation and digital systems for small businesses.

WHAT WE GET INTO

• Why security comms bounces: techy people talking to techy people, and far too many bullet points
• The subject line is the whole job. Get scrolled past and everything else you did was wasted
• The old rule was get it in front of people 7 times. Owen thinks it's now 70
• Run one message a quarter, not all of them at once. The bins analogy that explains why
• Gamification that costs nothing: tell them the finance team are beating them by 5%
• Hyper-personalisation past the first name, and video built on the fly
• Nobody outside your team knows it's Cyber Security Awareness Month
• Ban WeTransfer and people will find a way round it. Go and talk to marketing instead
• Why fear works for about a month: the horror film a week his household sat through
• Fix It in 60: the worst cyber awareness poster we could manufacture

WATCH & LISTEN

Full episode + all episodes: whennobodyswatching.co.uk

Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb

Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204

ABOUT

The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know.

Website: cyberescaperoom.co

Podcast: whennobodyswatching.co.uk

LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/

#WhenNobodysWatching #CyberSecurity #SecurityCulture #Marketing

Your bank has texted you to say they will never call you. On the day they call you, you will not be thinking about that text, because your kid will be screaming and you'll be late for something.

That's where Katie Maycock starts, and she's never worked in cyber security a day in her life. That's exactly why she's here.

Katie runs GYST (Get Your Sh*t Together), working with companies on what pressure actually does to an individual, what it looks like in a team, and the ripple effect across an organisation. A decade in corporate sales first, then a business built on the science of pressure rather than the yoga mat. She also runs an escape room we built for her, and uses it to watch leaders make decisions with the clock running.

WHAT WE GET INTO

- Why attackers moved to the phone, why urgency works on distracted people, and the call that cost 30 grand

- The five things people do under pressure: drivers, analysts, harmonisers, shifters, sprinters

- Your set point, and why you fall to your instinct instead of rising to your training

- The first sign of stress is a change of habit, and your employer usually rewards it

- The ripple effect: the real risk isn't the person who burns out, it's the team absorbing their work

- What fear based leadership does to decisions, and why it outlives the leader who started it

- Fix It in 60: an inbox with a training email buried in it

WATCH & LISTEN

Full episode + all episodes: whennobodyswatching.co.uk

Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb

Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204

ABOUT

The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know.

Website: cyberescaperoom.co

Podcast: whennobodyswatching.co.uk

LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/

#WhenNobodysWatching #CyberSecurity #Vishing #Burnout

"You have gotta be nice to each other, kind of."

That's a psychologist being asked whether psychological safety just means everyone being pleasant. The "kind of" is the whole episode. "It's not psychological safety if everybody's so nice there's never any challenge."

Twenty years of research into why capable, well-trained people still make the wrong call under pressure. Bec McKeown has done the science, in defence, aviation and rail, and the science does not say send another module.

Her own research at Cranfield put a number on it. Procedural and decision-making skills need refreshing about every 8 weeks to stay at gold standard. After that they fade. So what exactly is the annual module protecting?

Bec McKeown is a Chartered Psychologist and the founder of Mind Science. She's also a magistrate, which is why she doesn't speed.

WHAT WE GET INTO

- Psychological safety is not everyone being nice to each other, and the difference matters

- Skill fade: 8 weeks, and the thing you trained for is going

- "You'll comply, but you're not engaged." The half of that sentence nobody measures

- Everybody knows the speed limit. Everybody speeds. Knowing and doing sit in different parts of the brain

- The Friday afternoon Bec nearly got phished, the day after her first VAT return

- Reason's Swiss cheese model, and why the person who clicked is only the first slice

- Aviation calls it a just culture. Cyber security fires the person who clicked

- Blame gets you silence, and silence is a much worse place to be

- Security awareness is a change management programme, and nobody runs it like one

- The real influencers in your organisation are not the boxes on the org chart

- "Just pick the most legal sounding answer." How people pass the test without learning anything

- They're not the weakest link. There are simply more of them

- Fix It in 60: our security awareness quiz, and what's missing from it

CHAPTERS

0:00 Intro

[add timecodes from the final cut]

WATCH & LISTEN

Full episode + all episodes: whennobodyswatching.co.uk

Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb

Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204

ABOUT

The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know.

Website: cyberescaperoom.co

Podcast: whennobodyswatching.co.uk

LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/

#WhenNobodysWatching #CyberSecurity #SecurityCulture #HumanFactors

Kieren Lovell has spent four careers watching people under real pressure: two years on nuclear submarines, mine disposal, setting up the cyber warfare division at the Norwegian Navy's frigate training centre, hunting pirates off Somalia, running computer emergency response at the University of Cambridge, and now the CISO chair at Pragmatic Solutions.So when he says the industry measures the wrong things, it lands differently.He refuses to run phishing simulations, even though every board asks for them. He thinks most tabletop exercises are discussion workshops with a slide deck. And when Amy asks who's accountable if the next breach turns out to be behavioural, his answer is two words: always me.In this episode:

• Why a click rate is set by whoever writes the email, so what you're really measuring is the security team's grammar• "We do the plastic metrics instead" — the command, control and leadership measures nobody collects• The military rehearses little and often: fire, flood, famine, every day. Cyber trains people for before an incident and never for during one• Labelling theory, explained via a 14-year-old boy, and why a wall of shame kills your reporting culture• The incident he had no playbook for• Why a ridiculous scenario can beat a realistic one• What he actually puts in front of his board, and what he refuses to• Fix It in 60: we hand him a real board update slide and give him 60 secondsRead the write-up and watch the clips: whennobodyswatching.co.ukWhen Nobody's Watching is the podcast about what people actually do once the security training's finished, hosted by Amy Stokes-Waters. New episodes fortnightly.Made by The Cyber Escape Room Co., a behaviour change company: cyberescaperoom.co

"I've clicked on my own simulation before."

Holly-Jane Grayling builds security awareness and culture for a living. She still got caught by her own phishing test. Rushed, mid-task, chased to finish her mandatory training. Because no one is immune, and that's exactly the point.

In Episode 1: The Insider, Amy Stokes-Waters sits down with someone who's spent over a decade on why people do what they do, for an honest, no-gotchas conversation about the gap between what security training says and what people actually do once the module's closed and nobody's looking.

In this episode:

• Why "people are the weakest link" is nonsense, and what they really are
• Designing for perfect conditions vs what happens in the real world
• Why 99.9% of the time it isn't a training need
• Compliance as a starting line, not a finish line
• Measuring behaviour change, not completion rates
• The one word that makes everyone's brain switch off

Plus the first ever Fix It in 60: Holly gets 60 seconds to fix a real piece of security content, live, on instinct.

More info: whennobodyswatching.co.uk
Connect with Holly: Holly's LinkedIn

When Nobody's Watching is a video podcast from The Cyber Escape Room Co., hosted by Amy Stokes-Waters. New episodes every fortnight.