All Things Human Risk Management

Episode #12Many security awareness programs eventually hit a plateau.Training completion rates look healthy. Phishing numbers aren’t terrible. But progress stalls. Engagement drops. And leadership starts asking a difficult question: are we actually changing behavior?In this episode, Eliot is joined by Anthony Davis, a security awareness leader with more than a decade of experience building and running programs across major UK retailers. Together they unpack why awareness programs plateau and what practitioners can do to restart momentum.They explore the warning signs that a program has gone stale, why compliance-driven training often fails to change behavior, and how awareness teams can move beyond annual training toward continuous engagement and real behavioral metrics.If your awareness program feels stuck - or your metrics haven’t moved in months - this episode offers a practical playbook for getting things moving again.What you’ll learn in this episode:How to recognize when your security awareness program has plateauedWhy high training completion rates don’t necessarily mean behavior changeThe biggest design flaws that cause awareness programs to stallWhy phishing reporting is a stronger metric than completion ratesHow to connect awareness programs with SOC insights and real threat dataWhy annual training alone rarely drives lasting behavior changeHow storytelling and relevant examples improve engagementPractical steps to restart momentum in a stagnant awareness programTimestamps:(01:03) Introducing Anthony Davis and his background in awareness programs(02:25) Early signals your program has stopped improving(04:00) How long to wait before intervening when metrics stall(05:05) Is a plateau caused by culture, content, or systems?(09:20) Why engagement and communication frequency matter(15:10) Behavior change vs policy and compliance training(30:00) Why mandatory annual training often fails to change behavior(39:05) Is annual security awareness training fundamentally flawed?(52:00) What high completion rates but low behavior change really mean(54:20) Why phishing reporting is one of the best behavior metrics(57:00) Turning real threats into targeted awareness messaging(59:00) Connecting awareness programs with SOC insights(01:01:30) One action every awareness team should take to break a plateauHost links:Eliot Baker: ⁠⁠https://fi.linkedin.com/in/eliotebaker⁠⁠Anthony Davis: https://www.linkedin.com/in/infosecant****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #11Using real breach stories in security training works... but only if you do it ethically.Real incidents make threats feel concrete, cut through “this would never happen to me” thinking, and drive behavior change. But they also carry real risk: victim-blaming, fearmongering, reputational harm, and loss of trust if handled poorly.In this episode, Noora is joined by David Badanes (Human Risk Management advisor) to unpack ethical security storytelling: how to use real breaches responsibly, where the line is, and how awareness teams can turn incidents into learning without becoming the villain.They break down why real stories outperform generic examples, what not to include when telling breach stories, how to operationalize ethical review with limited resources, and how empathy is the key to changing security behavior.What you’ll learn in this episode:Why real breach stories are more effective than made-up examples in security trainingWhere ethical security storytelling goes wrong and how to avoid victim blamingHow to decide whether a real breach is appropriate to use in trainingWhat awareness managers should include (and exclude) when telling real incident storiesHow to operationalize ethical review without heavy legal or HR overheadWhy empathy drives better security behavior than fear-based messagingHow to measure whether ethical storytelling is actually changing outcomesHow cultural context affects cybersecurity storytelling in global organizationsTimestamps:(00:00) Why use real breach stories in security awareness training at all(00:15) How do real incidents change employee behavior better than generic warnings?(01:18) Who is David Badanes and why ethical storytelling matters now(02:21) Why do real breach stories work better than fictional examples(03:40) What are the ethical risks of using real cyber incidents in training(05:03) What does ethical security storytelling actually look like?(08:27) How should awareness managers choose what parts of a breach to include(09:24) How do you operationalize ethical review with limited time and resources?(27:10) How does culture change what’s considered ethical security storytelling?(31:36) What good ethical storytelling achieves and what it avoidsHost links:Noora Ahmed-Moshe: https://www.linkedin.com/in/noora-ahmed-mosheDavid Badanes: ⁠https://www.linkedin.com/in/dbadanes****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #10Email security filters have never been better... and yet attackers are still getting through.In this episode, host Eliot is joined by Petri Kuivala (CISO advisor) and David Badanes (Human Risk Management advisor) to break down what actually makes it past modern defenses, based on analysis of 400,000 real attacks reported by users - not simulations, not theory.They unpack how generative AI didn’t invent new attack types, but dramatically scaled social engineering, why perfect grammar is now a warning sign, how MFA is being bypassed via session hijacking, and why humans remain one of the most effective detection layers when systems fall short.What you’ll learn in this episode:Why phishing emails still get through secure email gateways and which attacks filters miss most oftenHow AI is scaling social engineering through volume, personalization, and speed (not magic)Why “better language” and polished branding can now be stronger phishing signalsHow attackers bypass MFA using attacker-in-the-middle tooling and stolen session tokensWhy QR codes, voicemail (vishing), and non-email channels are becoming more effectiveReal-world examples of deepfake voice and impersonation attacks — and where the risk is headingWhat 400,000 real attacks reveal about human detection versus automated controlsWhy good training works — and how reporting behavior changes the economics of attacksWhat security teams should focus on when filters, MFA, and signatures aren’t enoughTimestamps:(00:00) Why do phishing emails still get through secure email filters?(03:20) What do real-world phishing attacks actually look like today?(06:40) How is AI changing phishing and social engineering attacks?(10:10) How can you spot AI-written phishing emails?(13:30) How do attackers bypass MFA and steal session tokens?(17:40) What is quishing, and why do QR code attacks work?(19:20) How does vishing work and why are voice phishing attacks increasing?(21:10) How are deepfakes used in real cyber attacks?(25:40) Can humans really detect phishing better than security tools?(29:10) Does security awareness training actually work against modern phishing?(33:00) What does the future of AI-driven spear phishing look like?Resources:Threat Intelligence Report 2025: Tactics, Trends & Risks: https://hoxhunt.com/guide/threat-intelligence-reportHost links:Eliot Baker: ⁠https://fi.linkedin.com/in/eliotebaker⁠David Badanes: ⁠https://www.linkedin.com/in/dbadanesPetri Kuivala: https://www.linkedin.com/in/petrikuivala****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #9“Security awareness training doesn’t work” makes for a punchy headline. But is the problem training itself - or the way most organizations still run compliance-driven, once-a-year programs?In this episode, host Eliot Baker sits down with global security awareness leader David Badanes to dissect the latest “training fails” narratives (especially the UC San Diego study amplified by the Wall Street Journal) and contrast them with what actually works in high-performing human risk programs.They break down the three failure modes of legacy awareness (content, cadence, culture), show how to rebuild around behaviour change and reporting, and give you language to push back when executives show up with the latest “training doesn’t work” article in hand.What you’ll learn in this episode:The three failure modes of legacy awareness programs: broken content, broken cadence, and broken culture.Why annual modules and quarterly cookie-cutter phishing tests create “security tourism,” not real habit change.How to rebuild around role-based, adaptive, micro-learning paths that challenge people at the right level.Where gamification, rewards, and opt-in “spicy mode” simulations help and where they can blow up trust.Why click/failure rate is a weak north star, and how to use resilience ratio, time-to-report, and real-phish-to-sim-phish pipelines instead. How to embed “stop work authority” into digital life so employees can safely slow down urgent requests across email, Teams, Slack, WhatsApp, and SMS.What the UC San Diego / WSJ study got right about bad training, where the methodology falls short, and how to brief your leadership on it.The qualitative signals that a culture-first awareness program is working (water-cooler conversations, proactive reporting, and cross-functional pull from finance, M&A, and beyond).Timestamps:(00:00) Why “training doesn’t work” headlines keep coming back(02:00) Content, cadence, and culture: three failure modes of awareness(04:30) From “security tourism” to continuous skill building(06:30) Rebuilding the model: people, process, then technology(09:00) Role-based and adaptive paths (and where AI actually helps)(11:00) Gamification, leaderboards, and avoiding public shaming(14:00) Opt-in “spicy mode,” emotional reactions, and handling backlash(19:00) Phishing beyond email: Teams, Slack, WhatsApp, SMS and more(21:00) Stop work authority: slowing down urgent requests without blame(22:00) Why failure rate is not your north star metric(24:00) Resilience ratio, time-to-report, and protecting your colleagues(26:00) Tying recognition and performance reviews to cyber-safety behaviour(28:00) Handling repeat clickers without creating fear and avoidance(33:00) The UC San Diego / WSJ study: what it got right and wrong(36:00) What “good” looks like when training actually worksResources:Wall Street Journal coverage of the UC San Diego cybersecurity training study: https://www.wsj.com/tech/cybersecurity/cybersecurity-training-study-f290518dOur take on the WSJ article: https://hoxhunt.com/blog/the-wall-street-journal-got-it-wrong-phishing-simulations-work-when-done-rightHost links:Eliot Baker: https://fi.linkedin.com/in/eliotebakerDavid Badanes: https://www.linkedin.com/in/dbadanes****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #8Security leaders don’t need more headlines - they need inbox reality: what bypasses filters, what people click, and where to train next.In this episode, host Eliot Baker sits down with Maxime Cartier, Hoxhunt’s Head of Human Risk Management, , to unpack the State of Phishing 2025: why SVG attachments spiked, what still works, how the Microsoft vs. Google stack changes the threat mix, and the training moves that actually change behavior.What you’ll learn in this episode:Why SVGs surged: “image-as-code,” how attackers weaponize it, and a typical kill chain.What still works: PDFs/HTML + DocuSign, HR, and fake voicemail lures.Inbox layer > filter layer: focus on what reaches people, not what got blocked.Microsoft 365 vs. Google Workspace: different lure patterns, different coaching.Metrics that matter: report rate and time-to-report vs. legacy completion stats.“Report > Don’t Click”: building a high-signal reporting culture without blame.Verification tactics: quick cross-channel checks that prevent costly clicks.Program design: simulate what’s bypassing now and coach with instant feedback.Timestamps:(00:38) The Cost and Prevalence of Phishing in the Age of AI(02:11) Good News in Cybersecurity Reports(03:25) The Importance of Effective Security Training(06:34) AI's Role in Scaling Phishing Attacks(08:15) Deep Dive into AI-Generated Phishing(13:37) AI in Personalized Spear Phishing(16:52) The Threat of DeepFakes(18:16) Real-World Examples of DeepFake Attacks(25:00) Spotting DeepFakes: Tips and Tricks(27:32) Phishing: The Dominant Threat(28:51) Top Phishing Trends for 2025(38:38) Industry-Specific Threats and Insights(42:16) Innovative AI Solutions for CybersecurityResources:SVG Phishing Email Attachments (Mini-Report 2025): https://hoxhunt.com/blog/svg-phishing-email-attachments-mini-reportOur guide to deepfake training: https://hoxhunt.com/blog/deepfake-attacksHost links:Eliot Baker: https://fi.linkedin.com/in/eliotebakerMaxime Cartier: https://se.linkedin.com/in/maximecartier****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #7Security leaders don’t need more slides - they need messages that move budgets, influence behavior, and reduce risk.In this episode, host Eliot Baker sits down with CISO and author ⁠Jeffrey Brown⁠ to unpack a practical security communications playbook: metrics with a job, and how to build a report-button culture without blame.What you’ll learn in this episode:How to use Bottom Line Up-Front (BLUF) to get faster decisions from executives and the board - and when not to. Turning “security talk” into business outcomes: mapping risk to revenue, resilience, and cost.Metrics that matter: designing KPIs that show behavior change, not just completion rates.Building a non-judgmental reporting culture (and why “Report > Don’t Click” works).Instant feedback loops: faster reinforcement without punishment in phishing drills.Story-first, stat-supported narratives that land across technical and non-technical audiences.Practical cadences and mediums: what to send to execs, managers, and the whole org and how often.Using analogies (brakes & airbags) to make layered defense memorable and actionable.Timestamps:(00:00) Introduction and Guest Introduction(01:25) Jeffrey Brown's Background and Career Path(03:22) The Importance of Communication in Cybersecurity(06:10) Effective Cyber Awareness Strategies(09:12) Challenges and Solutions in Cybersecurity Training(25:48) The New Mandate for Security Leaders(26:47) Effective Communication Strategies(30:14) Building Influence and Relationships(34:11) Crisis Communication and Incident Response(39:34) Engaging with the Board and Continuous ImprovementResources:Our guide to to deepfakes: ⁠⁠https://hoxhunt.com/blog/deepfake-attacks⁠⁠Hoxhunt guide to managing repeat clickers: ⁠⁠⁠https://hoxhunt.com/blog/repeat-offenders-phishingHow to change the narrative around security: https://hoxhunt.com/blog/changing-the-security-narrativeHost links:Eliot Baker:⁠⁠⁠⁠ ⁠https://www.linkedin.com/in/eliotebaker/⁠⁠⁠⁠⁠Jeffrey Brown:⁠ ⁠⁠⁠https://www.linkedin.com/in/jeffreywbrown****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠⁠Hoxhunt⁠⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #6“Trust the pause, not the voice.”Voice clones and live-meeting deepfakes have collapsed the gap between “that would never happen here” and “finance just sent the wire.”In this episode, host Eliot Baker sits down with Dr Jessica Barker MBE to discuss her book , 'Hacked' and to dissect two escalating threats - virtual kidnaps by voice clone and executive impersonation on Teams/Zoom. What you’ll learn in this episode:How virtual kidnapping scams use short audio to clone a loved one’s voice and what the attackers really wantWhy emotions (panic, urgency, flattery) are the exploit, and how to train the “pause-verify” reflexA breakdown of the fake-CFO-on-Teams play, and the checks that stop itHow to design culture as a control: empathy, non-judgmental reporting, and faster incident responseStory-first, stats-supported communication that changes behavior (not just awareness)What to teach employees’ families about clone calls without fearmongeringTimestamps:(00:00) Introduction and Welcome(00:24) Dr. Jessica Barker's Background in Cybersecurity(01:47) Receiving the MBE: An Honor in Cybersecurity(03:44) The Importance of Storytelling in Cybersecurity(06:37) Real-Life Cybersecurity Stories(11:42) The Rise of AI and Deepfake Threats(21:56) Combating Social Engineering Attacks(26:53) Effective Communication in Cybersecurity(33:40) Key Takeaways for Security Awareness Leaders(36:47) Conclusion and Final ThoughtsResources:Our guide to to deepfakes: https://hoxhunt.com/blog/deepfake-attacksHoxhunt's HRM playbook: ⁠https://hoxhunt.com/guide/human-risk-management-playbook⁠Hacked: The Secrets Behind Cyber Attacks: https://www.amazon.co.uk/Hacked-Uncovering-Strategies-Secrets-Attacks/dp/1398613703Host links:Eliot Baker:⁠⁠⁠ ⁠https://www.linkedin.com/in/eliotebaker/⁠⁠⁠⁠Dr Jessica Barker:⁠ ⁠⁠https://www.linkedin.com/in/jessica-barker/****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠⁠Hoxhunt⁠⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #5“We have 100% completion… but nothing’s changed.”It’s a complaint security leaders are making louder and more often. Completion rates are being called “cosmetic,” “misleading,” and “just optics” - metrics that check the compliance box but fail to reduce real human risk.In this episode, host Eliot Baker sits down with Maxime Cartier, Head of Human Risk at Hoxhunt, to unpack what organizations are getting wrong about measurement and what the most mature programs are doing instead.Drawing from Maxime’s recent insights at the SANS Security Awareness Summit, this conversation cuts through outdated KPIs and explores what actually signals behavioral change. You’ll hear what practitioners are building in the real world, how to bring leadership along without losing them in complexity, and how to measure success beyond tick-box numbers.This isn’t theoretical - it’s tactical guidance from a field that’s evolving fast.What you’ll learn in this episode:Why 100% training completion doesn’t mean behavior has changedHow to spot “vanity metrics” and what to replace them withWhy security programs are borrowing measurement models from public health and road safetyWhat early signals suggest real change (even before risk metrics improve)How to make behavioral metrics land with your board, not just your CISOTimestamps:(00:52) Maxime Cartier's Conference Insights(02:16) The Problem with Training and Behavior Change(03:40) The Misleading Nature of Completion Rates(07:05) Advanced Metrics and Dashboards(12:48) Behavioral Change and Public Health Parallels(16:59) Early Indicators of Behavior Change(19:39) Moving Beyond Compliance: Internal Buy-In(35:43) The Power of Storytelling in MetricsResources:Our guide to the essential metrics you should be measuring: https://hoxhunt.com/blog/4-essential-phishing-metrics Hoxhunt's HRM playbook: https://hoxhunt.com/guide/human-risk-management-playbookBird & Bird case study: https://hoxhunt.com/case-studies/bird-bird-cybersecurity-rules-in-favor-of-the-hoxhunt-human-risk-management-platformHost links:Eliot Baker:⁠⁠ ⁠https://www.linkedin.com/in/eliotebaker/⁠⁠⁠Maxime Cartier:⁠ ⁠https://www.linkedin.com/in/maximecartier****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠⁠Hoxhunt⁠⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #4AI might be transforming cybersecurity… but not always in the way vendors want you to believe.In this episode, Eliot Baker sits down with Hoxhunt CTO and Co-founder Pyry Åvist to expose what’s actually happening at the front lines of the AI-powered phishing threat. No speculation. Just real research, real data, and real implications for your defense strategy.Together, they unpack how Hoxhunt’s research team built and tested agentic AI spear phishing agents and what happened when those AI-generated attacks went head-to-head with elite human red teamers. The result? A 24% higher failure rate for AI phishing emails, across 50,000+ real-world simulations. This is more than just a stat. It’s a signal: AI threats are getting smarter, faster than most training programs can adapt.This episode is both a behind-the-scenes look at the largest AI phishing benchmark ever run and a tactical guide for what to do next.Here’s what you’ll learn in this episode:How AI spear phishing attacks crossed a key threshold in spring 2025 and why that changes everythingWhy traditional training templates and static simulations are now a liabilityWhat “agentic” AI really means and how it’s enabling scalable, personalized phishing at unprecedented speedThe common weaknesses attackers exploit (and how to pressure-test your own workforce against them)How training programs can use AI to fight back, with individualized simulation paths that actually evolve with the threatTimestamps:(00:38) Hoxhunt's AI-Powered Approach(01:13) The Evolution of AI in Phishing(02:21) AI's Dual Purpose: Good vs. Evil(04:08) The Rising Cost of Phishing(05:50) Human vs. AI in Phishing Attacks(08:45) The Skynet Moment: AI Surpasses Humans(16:15) The Future of AI in Phishing(17:55) Conclusion and Final ThoughtsTo get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter:⁠⁠⁠ https://hoxhunt.com/all-things-human-risk⁠⁠⁠Resources:Our research on AI phishing vs human red teams: https://hoxhunt.com/blog/ai-powered-phishing-vs-humansA breakdown of the current threat posed by AI attacks: https://hoxhunt.com/blog/ai-phishing-attacksHost links:Eliot Baker:⁠ ⁠https://www.linkedin.com/in/eliotebaker/⁠⁠Pyry Åvist:⁠ https://www.linkedin.com/in/pyryavist/****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠Hoxhunt⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte. 

Episode #3Should We Punish Employees for Security Mistakes?Eliot is joined by Noora Ahmed-Moshe VP of Strategy & Operations, Hoxhunt) for a discussion on one of cybersecurity’s most divisive questions: should repeat offenders in training programs be punished... or is there a better way?Leveraging on behavioral science, real-world case studies, and Noora’s global experience advising security leaders, this episode breaks down the flawed logic behind punitive training and surfaces more effective, scalable alternatives.Here’s what you’ll learn in this episode:Why punishment-based training strategies often backfire and how they can destroy psychological safetyHow to understand the psychology of repeat clickers and uncover hidden motivationsWhat neuroscience and behavioral science say about fear vs. positive reinforcement in learningHow real organizations shifted from punitive to positive - and saw massive gains in threat reporting and engagementWhy individualized, adaptive training paths outperform one-size-fits-all modelsWhat to do when even your best-designed training isn’t working for a small subset of usersThe unintended consequences of using HR as a disciplinary tool in security awareness programsHow to counter the “optics of leniency” argument with data and outcomesThis isn’t about being soft. It’s about being strategic. If your goal is measurable, sustainable behavior change - this episode is essential listening.Timestamps:(00:00) Introduction to the Podcast(00:30) Setting the Scene: The Dilemma of Punishing Employees(01:20) Understanding Behavior Change(03:08) The Pitfalls of Punitive Approaches(05:08) Real-World Consequences of Fear-Based Strategies(07:26) Exploring Positive Reinforcement(11:22) Addressing Repeat Offenders(37:05) The Role of HR in Security Training(40:42) The Importance of Psychological Safety(48:05) Final Thoughts and SummaryTo get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter:⁠⁠⁠ https://hoxhunt.com/all-things-human-risk⁠⁠Resources:A short guide to effective security behavior change: https://hoxhunt.com/blog/cybersecurity-behavior-changeQualcomm Case Study: https://hoxhunt.com/case-studies/how-qualcomm-used-targeted-security-awareness-training-for-employeesGuide to positive vs punitive approaches: https://hoxhunt.com/blog/punitive-vs-positive-cybersecurity-awareness-trainingHost links:Eliot Baker:⁠ ⁠https://www.linkedin.com/in/eliotebaker/⁠⁠Noora Ahmed-Moshe:⁠ https://fi.linkedin.com/in/noora-ahmed-moshe****All Things Human Risk Management is a Hoxhunt Original Podcast.⁠Hoxhunt⁠⁠ is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.