Dear renegades, mavericks, and deviants,

Please can I share an idea with you? Not a behavioral security framework, model, or methodology …just an idea that I think has the potential to change how you see your role, your organization, and possibly even yourself. (Which sounds quite lofty, I grant you, but bear with me on this, as I really do think there’s something in it.)

The idea is called high agency.

If you haven’t come across the term before, it’s because most people haven't. But once you understand it, you’ll see it everywhere. Trust me.

The jail cell test

Here's how George Mack – the writer who's spent years defining the concept – first explained it: Imagine you wake up in a third-world jail cell. Dirt, sweat, zero context (the stuff of nightmares). You’re given one phone call – who do you call?

Take a second to actually think about it.

The person you just pictured – that quality they have, that spark, that je ne sais quoi you instinctively reached for – that's high agency. Mack calls it the most important and under-discussed idea of the 21st century. He is a marketer though, so probably more prone to exaggerating everything than the rest of us, but I do think he might be right. (No shade, my marketing lovies – them's just jokes 😀 ).

So, what actually is high agency?

Mack's simplest definition is this: are they happening to life, or is life happening to them?

High agency people (i.e. the people you'd call from that jail cell) are happening to life. They don't look at a closed door and accept it as a wall. They look for a key, try to pick the lock, or climb through the window. If the window won’t open, they find a different window. The obstacle isn't the outcome; it's just where the work starts.

The people you wouldn't call? Low agency people. Life is happening to them – things happen, they report them, and they wait. They’re often incredibly good, perfectly reasonable people, by the way – no judgement here – …but they accept the constraints placed upon them. Which just means they’re probably not who you’d call in a crisis.

I see it as a spectrum (as opposed to a binary trait you either have or don't) with low agency at one end, and high agency at the other. Everyone is somewhere on the spectrum, but we sit in different places on it, depending on the issue(s) we’re facing at the time.

What I mean by this, is that someone who's relentlessly resourceful in their personal life might be completely passive at work. And equally, there could be those who are transformative in their field and make a massive difference, but might be low agency about their own career. Although generally, my experience is that the more high agency a person is, the more they approach things in their life in a high agency way. That said, I’m convinced high agency isn't a fixed characteristic. I think it's contextual, situational, and (crucially) movable.

It doesn't always look like building something

I love one of the images Mack uses to illustrate the point. The image is mega, and so is the story. There's a photograph from Hamburg, 1936: a Nazi rally, hundreds of people in the frame, right arms raised in salute. Except one man. He's standing with his arms crossed. His name is believed to be August Landmesser.

He wasn't making a calculated strategic move, nor (I suspect) was he waiting to see if others would follow. He just wouldn't salute. He'd joined the Nazi party, gone along with things for a while, then fallen in love with a Jewish woman and somewhere in that, hit a point of no return. He was later imprisoned, and his wife died in a concentration camp.

He probably knew what it would cost him, and he still wouldn't raise his arm. That's a different kind of high agency to the one most people talk about. It's not resourcefulness or problem-solving, so much as the refusal to go along with something you know is inherently wrong, in an environment designed to make conformity feel not just normal, but mandatory.

I'm not drawing a direct line between Hamburg in 1936 and your security program in 2026. But I am pointing at something. The low agency trap in our field isn't usually “I don't know what to do.” It's more often, “I know what should happen, but I'm waiting for permission, or consensus, or for someone more senior to say it first.”

Landmesser didn't wait.

The Wright brothers’ story (starring their sister, who you probably didn’t know about)

While Landmesser shows us agency through defiance, Wilbur Wright shows us agency through the ‘impossible’.

It's 1885. Wilbur is 18 with a bright future ahead of him, and a place at Yale lined up. Then a local man smashes his face in with a hockey stick. (For context, that same man apparently later murdered his own family, so, nice guy.) Wilbur spends years bedbound, caring for his dying mother, with all thoughts of Yale out the window. But from that sickbed, he became obsessed with one question: if birds can fly, why can't humans?

At the time this wasn't just ambitious, it was genuinely considered insane. The New York Times had literally published a headline declaring man wouldn't fly for a million years, and experts agreed. In their defense, the evidence overwhelmingly backed them up – everyone who'd tried was dead. So, that’s fairly conclusive.

But Wilbur's conclusion was simple: Birds fly, flying doesn't defy the laws of physics, so humans can fly, therefore he could fly. And so it came to pass.

From there, everything was a question of resourcefulness and motion. No internet, no guidebooks, no aeronautical engineering courses. Just letters to libraries, homemade wind tunnels, and a custom aluminum engine he and his brother built themselves, because every existing engine was too heavy. Then they took a 700-mile journey to a beach in North Carolina, because that's where the wind conditions were right. Locals called them “the two poor nuts”.

On December 17, 1903, Wilbur flew for 59 seconds.

The New York Times headline declaring this impossible was published just two months prior to this.

The little known part of this story, is that there were three of them, really, not just the two brothers. There was Wilbur, his brother Orville, and their sister Katharine. She was educated, fiercely capable, and remains almost entirely absent from most tellings of this story, to this day.

• Yet through the years of building and testing, she funded the work, managed the correspondence, and navigated the press.
• When Orville was seriously injured in a crash during a military demonstration in 1908, she dropped everything and nursed him through his recovery.
• When Wilbur went to France that same year to demonstrate the aircraft to a deeply skeptical European audience, she joined him, and by most accounts was a significant reason the trip succeeded.

None of this shows up on the technical drawings, yet all of it made the flight possible. In 1903, that was probably the most agency a woman in her position could exercise – and (thankfully for all involved) she exercised all of it. So really, the Wright brothers’ story is actually a story of three siblings – each of them, in their own way, refusing to accept the hand they were dealt, with Wilbur possibly the most high agency of them all.

But what I love most about the story in the context of high agency isn’t that Wilbur was special, it's that he was operating with a different set of beliefs about what was possible. He believed problems were solvable unless they defied the laws of physics, and he had a bias toward action rather than rumination. When people in authority said no, he didn't stop, he just found a different angle. And, I suspect, he left few, if any, stones unturned.

Mack describes high agency as a tricycle. If you remove one wheel, the whole thing stops working. The wheels are:

• Clear thinking
• Bias to action
• Disagreeability

Now let's talk about your world for a moment

Agency is a characteristic of systems, not just a trait carried by individuals. 

Mack uses SpaceX and Northern Rail in the UK as his contrasting examples on the spectrum. One catches rockets out of the sky with giant chopsticks, the other (as recently as 2024) was still running on fax machines (yes, really). Not because the people inside it were stupid or didn't care, but because something about the system, the incentives, the culture, and the structure, made high agency behavior harder to sustain than low agency behavior.

Interestingly (and I say this with respect and love) many security awareness and human risk functions weren’t – and still aren’t – designed for high agency.

They were/are built to execute a program, deliver it, run a phishing simulation, and hit a completion rate. They focus on activity, not outcome, and their mandate comes from compliance, not strategy. The identity of the function (even its name, for a long time) was built around awareness and informing people, not truly holding ourselves and our organizations accountable for changing what they do.

That's a low agency frame baked into the job itself.

And here's where the spectrum idea becomes genuinely useful, rather than just interesting. Because the answer isn't “be more like Wilbur”. Most of us aren't realistically going to bed obsessing over an unsolvable problem with the stubborn conviction of someone who genuinely believes the laws of physics are on their side. (Well, some of us weirdos do… :-))

The questions for you are smaller and more practical than that: Where, specifically, are you accepting a constraint that isn't actually fixed?

• Is it the stakeholder who keeps refusing you access to behavioral data you need?
• Have you really tried three different angles, or did you accept “not now” as a verdict rather than a waypoint?
• Is it the leadership team that won't engage beyond an expectation that you need to educate your way to behavior change?
• Have you reframed what you're trying to explain in their language, or are you still presenting it in the way it makes sense to you, rather than them?
• Is it the CISO who sees you as the training person rather than a risk manager, or a secure behaviors engineer?
• Have you given them a reason to see you differently, or are you waiting for permission to show up differently?

The low agency version of all of these is reasonable and makes sense. And, nobody's going to pull you up for it. But the high agency test is blunter than that:

If your life depended on getting this done by tomorrow,
what would you do?

That answer usually exists, it's just harder, or more uncomfortable, or a bit above what you feel like you're supposed to do without permission. That's the high agency path. The question isn't whether you always take it, so much as whether you're even asking it.

I love this idea and line of thinking. Largely because it gives words and form to something I’ve always believed. It came up in a session with our leaders recently, and I see it everywhere. By which I mean in good decisions I've made, and also in my not-so-good decisions. I also see it in the difference between the people in this field who are genuinely moving things forward, and the ones who are doing lots, but not achieving much.

If you want to delve deeper into this, George Mack's original essay and the Modern Wisdom episode he did with Chris Williamson on this (episode #919, nearly two hours long, but worth every minute) are the best starting points if you want to go deeper. I'm pointing you to them rather than trying to contain everything here, because this is one of those ideas you need to spend time with rather than skim.

Give it a read. Ask yourself where on the spectrum you sit, and where your program sits.

Then ask what you'd do about it if your life depended on it.

– Oz A

P.S. I'm genuinely curious where people locate themselves on this – and whether the function question resonates or stings. Let’s grab some time, I’d love to chat.

Oz Alashe

CEO and Founder, CybSafe

What did you think of today's email?

Your feedback helps me create better emails for you!

Was this email forwarded to you? Sign up here.