Four questions that change how
your CISO sees you

Dear renegades, mavericks, and deviants,

Picture this.

Your CISO pulls you aside after a leadership meeting. "We need to trim some fat," they say. "Walk me through what we'd lose if we scaled back your program."

You mention completion rates. Phishing simulation scores. Maybe some engagement numbers from your last campaign.

They nod politely. And move on.

But here’s the cold, hard truth: that nod wasn't reassurance. It was tolerance.

Because completion rates don't speak the language of risk, and they don't speak the language of budget decisions either. While you’re reporting attendance and engagement, the leadership team that controls headcount, investment, and strategic influence is listening for something else entirely. Namely, business impact and headcount justification.

The frustrating part? You’re likely doing the right things. The tragedy is that the way most programs are framed makes it nearly impossible to communicate their real value. It’s like trying to describe a symphony by counting the number of chairs on stage. And quietly, somewhere, most of us know it.

So let me offer you something. Not a criticism, a frame.

Four questions. If you can answer them, everything changes.

Not just what you measure, not just how you report. How you're seen, how you're used. Whether you're invited into strategic conversations or handed another training & comms calendar to fill in.

Here they are:

Which behavioral patterns are quietly increasing our exposure to a security incident?

This is the diagnostic question. We aren’t just asking “who clicked the phishing link,” but what persistent patterns of behavior — across teams, roles, and contexts — are quietly creating risk?

Think about:

The silent majority, who never report suspicious messages
The Shadow AI pioneers, who adopt tools faster than your policies can keep up
The ‘convenience kings’, who save sensitive credentials in browser-based sticky notes

Then consider: Credential sharing. AI misuse. Shadow AI and SaaS adoption. Reusing compromised credentials. Sharing or saving sensitive information in the wrong places. Granting AI tools more access than the organization wanted or intended.

Yes, the list goes on.

But these aren't edge cases. They're happening right now, across most organizations. And security leaders know it.

What they often don't know is how much they can actually do about them at the behavioral level. Because these aren't one-off events, they're habits that form patterns.

Habits (although stubborn) are measurable. And the patterns they form are manageable… if you can see them.

Programs that can tell you which behavioral patterns are increasing your exposure aren't just running awareness campaigns. They're informing risk strategy.

What behaviors are actually shifting as a result of our interventions?

This is the ‘so what?’ measurement question. And it's harder than it sounds. It’s also where things get spicy.

Most programs that focus on behavior tend to narrow their gaze almost entirely to phishing reporting. Which is a reasonable place to start. They celebrate when reporting numbers go up. Fine.

But that’s only half the picture.

What about the (often untracked) reduction in people who never report at all? That’s where the real signal lives, hiding in the shadows of your spreadsheet. And most programs miss it.

.

And even if they didn’t, phishing reporting is just one behavior. The question is whether your interventions are shifting behavior across the full landscape of what actually matters, like: AI misuse, Shadow AI and SaaS adoption, the reusing of compromised credentials, oversharing sensitive information.

These are the behaviors that need addressing. And if you can't say with confidence whether anything has changed as a result of what you're doing, then it's worth asking what your program is actually for. (Other than making the auditors feel warm and fuzzy.)

How do positive and negative security behaviors impact our resilience?

This is the question almost no program is asking. And it might be the most important one.

Most organizations are wired to look for what's breaking. We hunt for the ‘oops’ moments: incidents, near-misses, risky behavior caught in a simulation. And that's understandable.

But to genuinely understand resilience, you need a clear view across four things: the presence of bad behavior (the active risks), the absence of bad behavior (the ‘dogs that didn’t bark’), the presence of good behavior (the proactive defenders), and the absence of good behavior (the invisible vulnerability).

That last one is the kicker, and tends to surprise people. You can have a workforce that isn’t actively doing anything ‘wrong’ but isn’t doing the protective things that build real resilience either.

As in… no one flagging suspicious messages, no one applying good access hygiene, no one modelling secure habits. They are neutral — and in a breach, neutral is just another word for unprepared.

The absence of good behavior is invisible if you're only tracking negative signals. And yet it matters enormously. If you're only measuring what's going wrong, you're only working with a fraction of the picture.

Programs that can see all four dimensions can tell a richer, more honest story about where the organization actually stands. That's not a feel-good exercise; it’s a more accurate risk picture.

How quickly and precisely can we intervene once we identify a behavioral risk?

This is the operational question. It separates programs that report on behavior from programs that act on it.

When a risk pattern emerges — i.e. when a team consistently bypasses a control, or a role group shows elevated exposure — does it take you weeks to respond? Or can you deliver an intervention within hours? How long does it take your program to respond?

Days? Weeks?

And when you do respond, is the intervention targeted and personalized to what you actually know about those individuals, or is it the same generic communication sent to a large group of people who all have different behavioral profiles, risk levels, and contexts?

Speed and precision are the hallmarks of a mature program. Not just for reducing risk, but for demonstrating that your work is connected to the organization's security posture in a real, dynamic way. It shows the CISO that what you’re doing is a dynamic part of the security stack.

These four questions aren't a report template, they're a lens.

A lens through which serious, strategic human risk programs are built and evaluated. And the thing is, most programs aren't using it yet. Not because the people running them aren't capable, but because no one has explicitly named it as the standard to aim for.

So here it is, named.

The next time you're preparing a program review, a budget conversation, or a pitch to leadership, try this: Don't lead with what you've done, lead with which of these questions you can already answer, and your roadmap for the ones you can’t.

That shift alone — from reporting activity to answering questions that matter — is what gets you out of the training room and into the ‘War Room’, where security strategy is made.

And honestly? That's where you belong.

— Oz A

P.S. The job you're doing is more important than most of your organization realizes. The four questions above are a good place to start changing that. If you want to talk through how to apply them to your own program, book some time here. I'm happy to be a sounding board.