Awareness isn’t enough. It’s time your CISO heard this.

Awareness has moved on. Has your security leadership?

Let me guess...
You believe awareness, behavior, and security culture matter.
You’re probably doing everything you can to make that clear.

But chances are, your security leadership still sees SAT and phishing simulations as the answer to “the human problem.”

They think they’re tackling human risk.
But really… they’re just ticking boxes.

And that’s not an attack. It’s a reality check. One that many CISOs and security leaders need right now.

The human side of cyber is evolving fast

✅ Behavioral science and evidence-based practice are becoming the norm
✅ Better data and telemetry give us clearer visibility into risk
✅ Automation allows us to support people in real-time
✅ Security teams want more than awareness - they want measurable impact

Meanwhile, most orgs are still relying on completion rates, click stats, and phishing report numbers to measure success.

That’s not risk management. That’s comfort food.
And we’re all a little too full.

I've written something to help. 

It’s an open letter to CISOs and security leaders.

A (respectfully blunt) wake-up call.

🔗 Read: An open letter to CISOs & security leaders. 

It unpacks why traditional approaches fall short, what’s really changing in the space, and why it’s time to shift from training and awareness to human risk management.

If you’ve ever felt like your leadership doesn’t quite get it...

If you’ve been asked to "do some awareness" when the problem is behavioral risk...

Or if you're tired of explaining why click rates don't equal impact...

Share this with your leadership team. 

It might be the nudge they need. 

If they remember nothing else, ask them to remember these 4 things:

1. Knowledge != behaviour change, so don’t just default to more training, education or comms. Consider more effective interventions. 
   
   
2. You must focus on and measure individual security behaviors - or accept you have no idea whether you’re being effective.
   
   
3. Move beyond phishing simulations. Many other behaviors contribute to incidents - don’t ignore them.
   
   
4. Your workforce needs timely, relevant support. Give it to them.
   

We’re not here to raise awareness. We’re here to reduce risk.

The more security leaders who internalize that shift, the better off we all are.

So go ahead. Forward the open letter.

Start the conversation.

Because the future of human cyber risk isn’t about knowledge.

It’s about behavior.

Thanks for reading! 

Was this email forwarded to you? Sign up here. 

Oz Alashe MBE

CEO and Founder,

CybSafe