A risk-based approach to security means trusting low-risk employees with fewer controls so they can work faster, while tightening safeguards for those with sensitive access. Rewards for good behavior and continuous feedback work better than annual training to build a real security culture.
Chapters
If you're a vigilant user, you know, and you need to get your job done, maybe we should be actually reducing friction and like taking off controls and allowing you more freedom to act and innovate and drive change for the organization. And on the flip side, if you're a riskier employee or you have access to a lot of sensitive data, you're not taking appropriate actions, then it's appropriate to apply controls. And we can kind of think about that, you know, in a consequence of sorts, right? So rewarding good behavior, providing consequences or guardrails or nudges with negative behavior, like that's how you build a culture of strong security. And then again, I think one more point, it's really equally important, I said it earlier, which is we have to communicate. Because if you tell people that security's important and then they only hear from you one time a year for annual training or when you fail a phishing simulation and you're not giving them the feedback loop of, "Here's what you're doing well, great. Here's what you really need to improve," like that's not gonna reinforce that strong and positive culture that we're, describing.
