Understanding Human Based Cybersecurity Risks

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about human-based cybersecurity risks. And there's some interesting research and analysis that was recently published. And the statistical geniuses over at Scienta Institute provided some insights there. And this is really forged from data that was provided by living security, if I'm not mistaken. So if we really want to manage cyber risks that involve people, such as, well, social engineering attacks that can lead to ransomware theft, fraud, insider attacks, system compromises, so on and so forth, we really need clear insights. And today, we have a panel of experts that will dive into the analysis, tease out the behavioral security importance, and discuss the underlying cognitive vulnerabilities, all so we can better understand and manage cyber risks. So today I'm going to be talking with Wade Baker, the co-founder of Cyanta Institute, Ashley Rose, the CEO and founder of Living Security, and Shimona Banerjee, the founder of the MindShield Institute. Welcome all, and thank you for sharing your insights today on this challenging topic.

Appreciate you having us on here. It's going to be fun.

All right. So I do want to start with an open question to the panel here and then dive into the actual research report and some of the findings there. So I kind of want to lead off here and say, you know, the problems with humans in the loop. Cybersecurity is often mischaracterized as solely a technical problem, and yet technology hasn't solved that. And we have this wetware, humans, in the system originating from the attackers, definitely involving the defenders and impacting the victims. Why do humans pose such a problem to cybersecurity? Who wants to go first? Ashley, what are your thoughts? Why are humans a problem?

Why are humans a problem?

In cybersecurity now.

So I'm like, there's so many ways I could go with this. I think the first is to acknowledge like the extent of the problem. And so the recent Verizon DBI IR report talks about, you know, 75% of cybersecurity breaches are a result of some sort of human error, right? And, but what's really interesting, so what does that stat actually cause the industry to believe that like, that humans are the problem, like stupid humans, they're always, you know, causing issues. And so actually through this research, we came out with a couple interesting stats. So one, it's actually 10% of users that are responsible for about 73% of risk. So I think using sort of like the blanketed statement of like all humans are the problem is probably like the first thing that we need to counteract here. And then the other stat that we actually found was over 60% of users in an organization, their behavior is actually helping to produce vigilance. And so it's moving risk in the other direction. And so we're really faced with this like interesting dichotomy of like, okay, yeah, we have some risky users and risky behavior, But then we also have some users that are causing vigilant behavior, and they're causing us to be more secure. And so, you know, I think I want to start out by like contradicting the mindset, like the humans are always going to be the issue. We've actually shown that in fact, with the right empowerment, with visibility, with training, with controls, we can start seeing humans be one of like the greatest strengths of a cybersecurity program. So that's something that I'm really passionate about, but But, you know, at the end, like at the end of the day, why are we here? Humans aren't like X's and O's and 1's and 0's. And so, the traditional like cybersecurity staff that's been investing millions of dollars in like cybertech and tools, they're much more comfortable with like black and white, and people just are not that way. And so, we needed to take a different approach in how we handle that, how we manage risk around the human.

And Shimona, I mean, you work in this space in the cognitive security, and I know you work with situations, online victimization, it isn't just cyber, risk. It's victimization online, children, women, other people, vulnerable communities. Why is this human in the loop still such a problem?

So, I agree with a lot of what Ashley just said. I think there are two predominant reasons. One is technology wasn't built with the human in mind. Our systems were built to solve other problems, and it just so happened that humans are the ones using it. But the people who are designing it, the source of the design wasn't to actually move with the natural functionings of how we are. And so there's this constant sense of us having to adapt to this foreign technology that keeps evolving and we are trying to figure out. But in reality, there's a whole new approach that can be taken and I believe should be taken, which is designing systems to match the natural human patterns because humans are not stupid. We are one of— I would say probably the most cognitively intelligent species. We design these systems and we have more intelligence than all the artificial intelligence put together. And I believe, controversial, but always will. But we need to use that to adapt the systems to us and then we can actually optimize. I think cybersecurity also comes from that notion. It comes because systems were designed with failure or breaches being a bad thing, not taking that into consideration as a default, that yeah, that's going to happen if it's designed this way. The second thing is awareness and education. Definitely massive gap in all these technologies coming in. People, again, going into it because their work demands it, their school demands it, their peer demands it, without actually knowing what they are walking into. So it's kind of like driving a car blind just because you have to get somewhere, but you're not really practiced in driving. But I think that both those things can be changed. So I'm extremely optimistic about the fields of psychology, neuroscience, behavioral economics, all these now coming into the tech industry and the cybersecurity industry. There's a lot of opportunity.

So Wade, you're familiar with DBIR. I'm sure you've heard of it in your travels and you put out the IRIS report now every year, right? The Information Risk Insights study. So what are the numbers across the industry saying when it comes to the risks of humans in the loop?

Yeah, this is a good question. So, so, um, sort of to, to backtrack and connect some of these dots, you know, I have noticed just over studying lots and lots and lots of breaches. For those that don't know, I was at Verizon and I started the data breach investigations report there many years ago. So I've had a chance to study hundreds of thousands of security incidents over the years, and we still continue to do that. Matthew mentioned the Information Risk Insights study, not associated with the DBIR. It looks really at more of the financial loss side of security incidents, but, you know, over the last 20 years, that's, that's what I've been doing. And I can very clearly remember just the mindset, I think, with humans is wrong. Like the mantra when I started was insiders are 80% of risk. What was meant by that was malicious insiders. You know, the view was humans are malicious insiders are stealing all of our information. And that's the biggest threat we have to worry about. And I don't know, I think that was bad because if you sort of carry that assumption through, you end up with a completely different set of technologies and tools and all of these kinds of things than than what Ashley was saying, for instance, if yes, let's still say that humans are involved in 80% or 80% of risk, but it's not malicious, it's other ways that they are contributing, you'd arrive at a completely different set of practices and things you need to do to solve that. So, I kind of, I think for a long time we've been chasing the wrong side of the human risk problem, if you want to think about it like that. And that has definitely led to where we are. So, you know, We, we still continue to see, uh, you know, we looked at some trends over the last 15 years, probability of security incidents going up. And, you know, that's, that's pretty much, uh, across the board in all different types. Definitely see the vast majority of incidents and losses are tied to humans as a vector of an external party attacking you as opposed to the, the humans are the, the villain. I, I, I like to say vector versus villain, and that's been consistent with with every single dataset over many years that have been studying incidents. So, you know, one of these days, I think we'll start to see some changes there, but it's one of those problems that is everywhere and every single organization has it. Obviously they have people in the mix. And so it's one of those rare universals across the entire business sector.

So I liked what Mono started saying about, you know, we have awareness and training. And I think one of the issues of why we still are where we are is because we've had compliance-based training for the last, call it 15, 20 years, right? When we had like PCI and SOX, like everyone said, thou must like train all your users and check the box, right? And that was the answer. But then we'd look at Wade's statistics and Wade, I don't remember the exact year you came out with the DBIR when it started, but those stats have not dramatically improved. And so then you're faced with this dichotomy. And what we've seen is that organizations and CISOs have become disillusioned by the solutions that are in the market because they say, okay, we've had this problem forever. The solution existed, but we're not seeing improvement. And so there in fact lies the problem of overinvesting in technology, trying to solve a human problem. We're not really making any progress. And that's where, you know, cybersecurity came in with the birthing of human risk management, which I know we'll jump into. But I think it's really important to acknowledge that, like, there has been an attempt by industry to solve for this, and it's been around for decades. And, you know, we have not seen the progress that we're looking for.

Yeah, everybody who's had to take those classes or teach those classes, yeah, you know, we understand definitely the limitations and the frustration there. So, because you're bringing in kind of a historical perspective, just a quick foundational question here. You know, way back in the ancient days when DBIR first came out, it was revolutionary because it was the first one that was really using actuary data, real events instead of just people's opinions. Do you believe the information and data sets have gotten significantly better to understand the mechanisms of human risk since back then until now?

Yes, consistent as far as stats. And, uh, but there have been some changes, and I think, I think we still have some work to do there in the sense that different datasets based on how they are produced. And when I say datasets, I'm just talking about security event or loss datasets. They, they have different biases. So rewinding a long time ago when we first started publishing the DBR, it was only incidents that Verizon investigated, and I want to say it was like split between external attackers and some insider. Then we started working with the Secret Service and they contributed their sort of caseload data. And they had, I can't remember if it was the inverse, but it was a much more balanced set of events that they were investigating. And it just all had to do with why some, you know, somebody would hire Verizon or then it was CyberTrust to come in and work an incident versus not. And you can just do that with all the other, like disclosure mandated datasets. They're going to have their own biases. And I think a lot of those, the insider event gets dampened, you know, just because, I mean, insiders steal regulated data, sure. But I think they have a tendency to steal something like intellectual property that they know has value from their experience. Or when we report incidents, we might report some aspect that catches news headlines, but we don't really trace it through and see that, oh, okay, well, there was a vector of some human element involved in the chain of events, right? You just usually have pretty shallow reporting on how those things happen. So all that to say, Historically speaking, I think that it's hard to flush them out. And I think that's why one of the things that the DBIR does every year, they have pretty wide visibility to lots of different contributors into that. I mean, there's something like 50, 60, 70 different contributors to that report and you actually get to flush out those details and see it. Whereas most people's single source things, it's kind of hard to tell.

The bias is more pronounced, right, when you have single sources. All right. So let's, let's kind of jump into this recent report here. And Wade, I've got a question for you. And Ashley had mentioned it, you know, before there is a metric and it was more the kind of 73/10, I believe it is, right? This was the metric. About 73% of the risk-based behaviors or whatnot is caused by 10% of the users. And it seems to make sense. You've got certain apples in the barrel that contribute more to risk. But can you break this down? Because I got lots of questions here.

Yeah.

Is this consistent over time? Does this change? Does the 10% number change over time? Is it conditionally? I mean, are there other factors in and around this kind of 10%?

I'll answer real quick and I'll really honestly defer to Ashley on this because she knows a lot more about the sourcing of the data and those kinds of things. But I will say that you're correct in setting that up. You know, we have these risky behaviors identified through various means. And when you look at that just volume-wise, you have a relatively small set of users that are responsible for those. I don't believe that we looked at that over time, but it's a good idea and something we should do at some point, Ashley. But you do see differences. I know categorically right under that in the, in the report, we look at that ratio overall. It's 10%, 73% of risk. But if you look at like data loss versus identity and access, for instance, data loss is more like 75%. And identity and access-related misbehaviors more like 50%. So, you do see some differences there depending on what kind of risky events and behaviors you're looking at. But I don't know, Ashley, you have more context to add to that because, I mean, this is really your domain. We're just analyzing the data and saying, hey, seems to be an imbalance here. That's interesting. What do you think about that?

Yeah, absolutely. So I wanna zoom out even like one step further. So how does Living Security think about human risk? In the 10% number, we're looking specifically at behavioral risk. And so that is one component of what we think about as a driver of human risk in the human risk management context. We also look at two other factors that are really important from a prioritization perspective. So we're also looking at like event or threat context. What type of threats are coming inbound from external that are really outside of the user's control, but that would provide context to a user's risk? So that's important. The second piece is identity and access information. So who is this user? What do they have access to? If they were to become compromised, would this user have a larger blast radius, right, than someone else? And so, so this is one important factor. So I wanted to distinguish that. And then, yeah, to Wade's point, you know, a lot of our program owners are saying, you know, it's my job is to do behavioral change. And so we wanted to see like how much was behavior a driver of risk. And so we break that out as well. And then within that behavioral component, we're seeing on average across this report has about 100 different organizations, large enterprise, we're averaging out about 10% of those users. But what we really encourage our customers to do is take those additional contexts, the threat context and the identity and access context, and use that to even, like, slim down that 10% even further. So you might go from 100,000-person organization, and you may be finding people that have pretty poor behavior, But what we really want to find is the people that have bad behavior, plus they're getting highly targeted, and they have access to a lot of sensitive data. And you may slim this down to maybe a couple hundred, maybe it's in the tens. And then how are we setting controls? How are we training? How are we providing guidance, right, education to those groups of users so that we're really able to make kind of the biggest dent and the strongest impact from an ROI perspective in the risk management approach.

Got it. So you're breaking it out statistically to understand certain factors, the likelihood of something which is based on the type of attack and the actions that someone's going to take. Somebody going to click a phishing attack, for example. So you're looking at the risk of likelihood as, or as a factor of risk, but you're also looking at the risks associated with the impact of that particular person. If they are an administrator, obviously if they're compromised or that action has a greater consequence than the new hire intern because they have less access and so forth. So you're calculating that as part of this overall picture that you're painting, correct?

Exactly. And likelihood is going to stem from what's coming in externally. And then what does that exposure look like? What type of behavior Right? If they have poor behavior, the likelihood that they're going to become compromised, if they're getting attacked, is much higher, right? And then the impact could be wider, widespread, if they have more access, access to sensitive data, those types of things. Exactly.

Mona, you do a lot of characterization and analysis of end users. You're looking at the cognitive vulnerabilities that lead to behaviors that would be undesired in this particular context. Are you also seeing this kind of 10% being the source of 3/4 or 70% of the kind of overall risk to an organization?

So, to be very honest, we are very early in this field of tracing behavior to cognitive, specific kinds of cognitive traits, especially in cyberspace, because The industry of psychology has been around for a really long time, but what sometimes people miss is that people react very differently and act very differently in cyber than in the physical world. Cyber completely mutates behavior, and that happens because inhibitions are low. You know, there is this constant need to move fast, reduce effort, reduce friction, and consequences are intangible. If something that you were going to do in the physical world, now you can do in the digital world, and by the time someone actually finds that, and reprimands you, you know, you've probably gotten away with it. So because cyberspace has mutated behavior, what MindShield has been focused on understanding is not only what the cognitive traits are in an individual that lead to bad, or what we say bad behavior or risky behavior, but how does that actually translate into cyber behaviors specifically? So for example, you know, you can say like, 10% have bad behavior, but from that 10%, what exactly is causing that behavior? Because who that 10% is might actually change. There's no way— I mean, and I obviously, from the report I read, I'm assuming that that 10% is in relation to the total amount, but you might be part of that 10%. Next year, I might be part of that 10%. So who that 10% is is actually shifting constantly. And I think the reason for that is that circumstances change. People have different motivations at different points of time. Someone who was extremely honest and committed to a company might— something might happen in their life and suddenly they switch, right? So we need to understand one level. And I love the fact, by the way, Ashley and Wade, that you're looking at behavioral security. It's definitely the next big thing. I really am passionate about the level that goes even root of that, which is that cognitive personality layer. Because we realized that with those 8 cognitive traits that we are kind of distilled down to, if we can see from a personality standpoint, from who has what kind of biases, what kind of motivations, what kind of emotional triggers are they most susceptible to in terms of fear, urgency, all the tactics that are used in social engineering, we can get to the root of of how susceptible someone might be across time. So the goal here is, if you can create— what MindShield is doing is to create that cognitive profile so we can see, okay, based on Matthew's cognitive profile, in this situation he's good, he's safe. In this department, in this kind of a role, he's good. But say you are a very fast-moving person, right? Put someone like that in sales, great, they do a good job. But moving fast comes with own vulnerabilities because you're more prone to making mistakes, you're more prone to being distracted. Take someone who is more slow, more analytical in how they think, someone who works in the legal department. Their personality inherently is very different. So, if we can understand that down to a personality and a cognitive level, it allows us to really push that behavior change more effectively. And also, we know that behavior change has been— is really hard because you can teach humans to do and tell them and instruct them, do this, do that. And when the time comes, they will not, they don't because they just fall back into their natural patterns. However, if we can go down to the cognitive level and we can understand what's driving them, we can curate that training to put out a different kind of behavioral cognitive training that actually causes long-term change.

I think there's a couple of things here. Love that you're kind of pulling back the covers even more, right? We're trying to like double-click and double-click and figure out like at an individualized level, what is driving that person? And then probably also, how do they learn and how are they going to consume information? And so, because the next question that's always posed is, "So what? What are we going to do about it?" We went from a historical one-size-fits-all kind of blanketed approach to training across the organization to the next kind of level for organizations was, "All right, let's look at people's roles." What are, you know, what are they doing? What's their job responsibilities? How do we train them in the context of their role? So that was like, all right, how do we get a little bit more prescriptive? You know, we went to the level of, okay, now with this visibility on risk, both from a prioritized risk level, but also a behavioral level, we can get really targeted and very prescriptive and proactive about how we're training based on their behavior. You're saying that even if we can double-click on that, how we're training on that behavior could change and shift. I would say my, my only argument to that is that I think that organizations need to mature in Basically, they need to be putting up adaptive guardrails no matter what the psychology is for that user behind the scenes. They have risky behavior. Part of me doesn't care. I mean, look, it's gonna, like, it's gonna be great to understand why so we can take a better approach, but the fact that you just have risky behavior means you need to have more prescriptive guardrails up so you can do your job and whatever that job is in a secure way. So how do I put up those guardrails now, allowing us the time to understand like what's really driving that behavior, and then we can work with you to empower you and try to drive that behavioral change over time, because it's not going to be right away. So one thing I would love to see organizations start adopting would be more adaptive policies and controls based on just risk profiles of individuals, which would then give us, give us time to actually kind of dive deeper into that psychological profile. So that we could work on that behavior change over time. I think there's still some work to do there within enterprises.

That's sort of—

I'm starting to realize some of the challenges here, right? We've got a certain level of stickiness when it comes to the cognitive defaults that we all have, the own vulnerabilities we all have. And they tend to stick around unless you really try and change those. And those can be manipulated. In addition, we are looking at potential temporal changes based on environmental conditions. You may not be a disgruntled insider today, but if your boss has a bad day and yells and screams and throws coffee in your face, guess what you are tomorrow? You're now a disgruntled employee. So there can be environmental changes.

I would say like Charity: A Program is certainly a big driver. Um, because when you think about human risk management, um, and you think about the platform specifically, you can kind of relate it to SIM for the human. The output is only as good as the input data. And so, um, the more data sets that you integrate into the system, the more essentially visibility you're going to get. Um, you know, I think that organizations that are looking to take a more mature approach to human risk management intuitively and naturally sort of like opened up the dataset a little bit more. We could look at some, for instance, healthcare. If hospital datasets are on-prem, for instance, it may not be something that they're looking to share. And so then you're not getting the visibility to be able to act on. So, there's many different factors across the board that contribute to, to over— overall visibility. I think what really matters, who that user is in that timeframe could change. And there's different context that's important there. And so, what I would say as the major takeaway is that we need to have continuous monitoring. The same way that we do across our devices and our networks, like, users need to be treated in the same way. It's not enough to take a snapshot and say, "Okay, here's my 10% of risk users. I'm going to go target them. I'm going to train them. I'm going to put a, you know, a ton of policies and controls and like fire them, let them go, and like move on, it's not gonna solve your problem because environments change, contexts change, people's psychology change. So, we need to always be monitoring this, and we need to look for those indicators of risk when they arise so that we can be proactive in addressing them. That's really the major takeaway here. And then, and then secondarily is, of course, the more visibility, you know, the, the kind of smarter and more intelligent we're gonna be in how we and how we mitigate and how we react. And so, you know, I like— those are the kind of two major takeaways I want to leave with the audience today.

Well, you know, I love the fact that you're talking about constantly reevaluating, and this isn't a once-a-year, once-every-three-year kind of, let's see who the bad apples are, who do I have to send for 27 hours of training? I like that continual, given the fact that it is dynamic and there are other factors when it comes to behavior. And I've seen a lot of behavioral training that'll flash a phishing email and say, "Don't click this." Well, okay, how many emails do you have to flash, right? I mean, how many behaviors do you have to change? Because they're constantly evolving from the actions of their behaviors. And Shimona, from a cognitive, which is kind of at a deeper level, right? One cognitive vulnerability may actually determine whether someone's susceptible to an entire campaign of phishing or business email attacks let's say they're susceptible to bias of authority. And so any email that says, I'm your boss, whether they are or not, you know, go do X, they're going to go, they're going to tend to do it. Do you think that continually reassessing people is important at the cognitive level? Or is it people are just set in their ways and once you get a good beat on them, that's the way they're going to be?

So I want to actually add to what Ashley said, and then I'm going to answer this question, Matthew. So the, you know, when we talk about guardrails, I always like to use the analogy of driving, right? We always have, obviously, you know, we start learning to drive and then we have a driving instructor sitting next to us, and then we have a traffic signal that's made so that we do not crash into traffic, and then we have an airbag in case we crash our car. And so we can work with guardrails all we want, but at the end of the day, how good are you as a driver or how much you suck as a driver is going to determine if you get into an accident or not. Now, coming to even the concept of how society has changed in the last— since COVID if anything, you know, when we were all in office environments, we were locked in a controlled environment. It was very easy to monitor. It was very easy to set up guardrails. But now, the attack vectors are completely shifting. They've shifted out of just being email to being phone calls, to being SMSes, to being social media, LinkedIn messages, DMs. You can't monitor all of that because then that goes against some pretty big issues around privacy. So, when the professional and personal life blurs so much, those guardrails have their limits. And at that point, it's really up to the user, what we call cognitive security, which then starts acting. So in order to— coming back to your question, right, Matthew, like how do we essentially— what we saw in our research is that if you look at a tree, Right? You have a seed and then the seed blossoms into a tree with all these branches. We realized if you want to cut down a tree or you want to not have a tree grow, you can either cut off the branches or just uproot it. And the approach that we are trying to take is realizing that one cognitive, a specific cognitive trait leads to all these different kinds of behaviors. And sure, you can try and correct this and correct this, but it'll just manifest in somewhere, in some other way. So for example, you want to correct the behavior of someone not clicking on an email because of an urgency thing. Okay, how are you going to stop them from clicking on something that malicious, uh, link on a different website when they were shopping and that made them click because it was like they get some money off for a limited period of time? So we cannot— like, that's— it's very limited. But if you go down to the root and you're like, hey, urgency bias, this is something that is a part of your cognitive map, right? So anything that tells you you need to do something under a certain period of time, flat, flat, flat. And the beauty is, just like we drive, when we first started driving, we were all over the place, not really sure how to do things, super cautious. Eventually it became subconscious, and that switch was not very long. It was like, what, 2-3 months before you, you know, really got to drive. So we realized upon that kind of training that You can actually subconsciously change someone's brain to completely change their perception about how they're seeing something. And then when they see that online, it's like a shield. It's like a filter that automatically pops up with no technology needed. That's the beauty. And similarly, it's like sales training. You know, when people learn how to sell, they are sensitive to sales tactics and they don't fall for it because they can, they can immediately identify. That kind of resilience, I really think, is the future because the rate at which technology is advancing, if you're not focusing on human perception and human filtering, filtration systems, the attack vectors are only going to keep increasing and we're always going to be playing catch-up, and that's a tiring game.

So, it's a scalability issue because when we look at the cognitive, it's a one-to-many. If somebody has, you know, a cognitive vulnerability for urgency or authority and you teach them to be a little bit more resistant or aware of it, that means they're resistant to that email, they're resistant to the SMS message, they're resistant to the AI video chat that comes in and all those different things. And so you can then potentially tamp down those behaviors across, well, an infinite number of mediums that the attackers may leverage in the future, ultimately resulting in better behaviors or less risky behaviors and better metrics for Wave. So, you know, that works out well.

That's what it's all about at the end anyway, right?

I mean, exactly, exactly. So, you know, changing all of that, and I'm going to go back to technology is easy to configure. You can change a line of code, you can hit it with a hammer, you can do all that kind of great stuff. People frown on it when you do that to humans. Hitting them with a hammer is typically not accepted in most corporate environments. So what are those best practices? Because people can be resistant. I'm not really aware of too many people that are knocking on my door, "Hey, when's the next security training, Matthew? We are so looking forward to it." I mean, I do get a few of them, but how do we affect this change? And does it have to start with culture?

Yeah, I'll jump in here. So I started with a stat earlier that we're actually seeing as many as 78% of users are actually helping to reduce risk. And so, let's, you know, the job is not to fix everyone, right? It's to really identify those users that are causing risk, coach and empower them. And I think that's when we start seeing this lean to vigilance or this movement from risky behavior to vigilance. That's really what strong security culture would look like. And there's many ways to do that. But starting with visibility will allow us to elevate those security champions, right, and start addressing those outliers. I think it's equally as important to think about job titles and roles, and I'll give you an example. You know, so we had one customer that believed their contractor team was their weakest link. Like, they're like, "Oh yeah, it's contractors. Like, of course, like, these are going to be issues for us." But when we actually dove into the data, it showed that the real issue was their long-tenured internal team that was bypassing controls with weak credentials. And so if you look at that, right, like, I thought it was contractors, okay, but it's actually tenured individuals, then they, you know, they have weak credentials, that context completely changes the strategy, right, and their exposure. And so like, that's what I keep coming back to, the visibility piece, because we can't actually take appropriate action for our users and to guide them to do the right thing to ultimately like drive that strong security culture unless we have the visibility. To be able to make decisions from. And so, I think culture starts with visibility. It starts with prescriptive action. It starts with, like, actually democratizing security and, like, putting the data and the information in the hands of the users and the leaders to be able to, like, help set strategy and guide training, guide directives, and be able to make choices around certain controls, right? And, like, risk acceptance. That's, like, what we think about as strong culture versus, you know, I would say, like, Like sometimes people in the industry like get this other, you know, you think about startup culture, you're like, oh, people are playing, drinking beers, playing ping pong, right? It's not about that. It's about the decisions that you're making on a daily basis and how that's actually affecting the outcome for the organization.

So, it sounds like visibility has to be first. You have to know what you're working with. You can't identify the opportunities to turn the ship until you have visibility of where you're at and where you're going. The other thing I'm hearing is there's an opportunity for momentum as you do encourage champions out there that want to do the right things that are doing it, as you are rewarding people or whatnot, and you're building up that cultural resistance to doing bad things. If you're a new employee and you join a group and everybody is doing things a certain way, you're going to fall into that. You want them to all be doing safe things. Things, whereas you're a new employee and you go into an environment where everybody's doing risky things. Well, okay, you know what you're going to be doing. So, it sounds like there's opportunities here to create momentum at the behavioral level.

Yeah. Rewarding the good behavior and nudging, right, or training against, or applying controls or more friction, right? If you're a vigilant user, you know, and you need to get your job done, maybe we should be actually reducing friction and like taking off controls and allowing you more freedom to act and innovate and, you know, drive change for the organization. And on the flip side, you're risking your employee or you have access to a lot of sensitive data, you're not taking appropriate actions, then it's appropriate to apply controls. And you can kind of think about that, you know, in a consequence of sorts, right? So rewarding good behavior, providing consequences or guardrails or nudges with negative behavior. Like, that's how you build a culture of strong security. And then, again, I think one more point, it's really equally important, I said it earlier, which is we have to communicate. Because if you tell people that security's important, and then they only hear from you one time a year for annual training, or when you fail a phishing simulation, and you're not giving them the feedback loop of, "Here's what you're doing well, great. Here's what you're, where you really need to improve," like, that's not gonna, reinforce that strong and positive culture that we're describing. And so, we've seen like significant results of just like holding up a scorecard. It's like putting a mirror up in front of each one of your employees and saying, where do you stand? You know, we're all adults here. We're going to empower you now with the data to take appropriate action. And that has done, you know, has had significant advantages in a lot of our customers.

The visibility, communication, building momentum as you're shifting a culture. Does that also play at the cognitive level, or is that more of an individual battle with one person at a time?

So, when we look at cognitive, yeah, you can look at it down at an individual level. You can also look at it across a department and across an organization. Because one thing that I 100% agree with is awareness, and visibility allows and gives that awareness. So now you know where you are. Versus where you could be ideally. That's a great first step. The second step is relevance. The problem with security awareness training today, and the reason most people will just put it up on their screen and go grab coffee till the timer runs out, is because they— there's very little linkage and relevance in the way it's delivered to them. People— this is just unfortunate, but people have a lot going on. They want to get through these things. And when you have to sit them through training, the reason retention is really low is because they're not really engaged. It doesn't really add value to them. Even when I was going through my own security awareness training at my company, it all kept talking about, "This is how you can protect your organization from getting hacked and breached." And I could sense that people are like, "But, I mean, why would I care about my organization getting hacked? I mean, okay, I would, but like, okay." whatever, right? If you switched that to making it relevant to that person, you know, when you look at it cognitively, humans care about some primary things. We have to bring it down to the human level: connection and love, their wealth and financial security, health, and usually status or, um, like social cohesion. If it's not related to one of these things for them, it's not going to stick. And so in how security training is communicated, it has to be relevant to the individual about you. Imagine you have spent 40 years working in this company. You could wake up one morning and your bank account could be zero. It could happen because of one click. Now I'm listening. Your kid, this could happen to your kid. Now I'm listening. So in how the paradigm of security is, it needs to be established at the personal level, it will, as a byproduct, that behavior will permeate into how they behave in the workplace as well. But what's happening right now is the opposite. People are behaving in a certain way in the workplace because they're scared of getting reprimanded. They go home and it's all off and they're completely off rails and doing their own thing. That's the problem. So I think culture is not just about work culture. It's the paradigm and the culture of how we are talking about security. That needs to fundamentally change and become more engaging and relevant. And the third part is the consequences. The carrot versus the stick approach worked for kids. For adults, sometimes it works, but it does not— I feel like positive reinforcement, and data has shown that positive reinforcement plays a better and more effective role than negative reinforcement. Because when you are negatively reinforcing someone making a mistake, which means they have to go back into the security training or they have to give a presentation at lunch and be humiliated in front of their team. It causes, um, it causes even more numbness. It causes desensitization and increases to the burnout and the workload that most of our workforce is already facing, especially in those sectors. In healthcare, we have to see that these people are burnt out, say, in healthcare. So how do we reduce that load? How do we give them time to rejuvenate so they actually have time to process and take a step and is when they are actually responding. So I think culture is very, it's a very widespread term. It's not just about how, you know, security practices work. It's about paradigm of security, relevance to the person, positive reinforcement, and creating an environment where you're allowed to fail and make mistakes because you will be rewarded for that. Then I will report it faster, right? Now, if I get a phishing link and I click on it, I don't wanna report it. Now I'm just like stressed out. No, you wanna create an environment where people report, I made a mistake, oops, oops, oops, oops, and that's rewarded. And so when that happens, I think that culture would start flourishing.

Okay. So next question here, and I wanna, I'm gonna start with Wade. If you could only pick out 1 or 2 metrics, and I'm gonna ask each one of you this, what does success look like? What 1 or 2 metrics would you wanna see either in the broad scope, the industry, or with a particular organization? That would convince you, yes, success?

And yeah, I mean, that's a good question. I want to measure everything is my tendency, but when you, when you need to narrow it down to, to one, based on what I, what I've seen, I think the report that was released has a pretty good one in there in terms of if you, if you want to look at the human risk of an organization and you're just looking at the proportion of users in that organization that are categorized as high risk or risky, you want to see that dropping over time. I mean, it's going to go up and down. There's a chart in the report where very faint gray lines in the back and you can just see them zigzagging all over the place. And it's, uh, Everybody's been saying this, but I mean, the, the, it changes over time. It's not static. So, but over time, on average, you want to see that risky population decreasing, I think is a good measure of success and that you're maturing and getting the problem under control and reducing, uh, reducing.

So Ashley, same question to you. What metric would you like to see that you would feel most confident in, in saying, yes, we're having a positive impact, or this is a good organization?

Yeah, so we came out with that— the metric that Wade is referencing, it's called the Human Risk Index. That's, uh, what we sort of like use as our, our guiding light for all of our organizations. So, the Human Risk Index improving over time is what we're looking at. And then be— beneath the Human Risk Index, what drives that is exactly what Wade Wade said, we're looking at, we wanna see those high-risk users, we wanna see them lowering and decreasing their risk, and then we wanna see those neutral users moving into a more vigilant state. So if we can see those two things happening, risky users moving, you know, to the right, getting more vigil— more vigilant, and then if you're in a neutral state, you actually are producing those positive behaviors like Simona mentioned, right? We wanna see people that, like maybe they're not clicking on emails, but we want to see them start to report it, right? We want to see— maybe users are, you know, starting to reset their credentials and setting stronger credentials. Maybe they're doing proper data handling, like all of these positive and vigilant behavior traits. Those are the things that we're really looking to drive as an organization.

So it's an uplift of characterization based upon their behavioral actions, really. In what would be considered risky. Shimona?

Well, we obviously have this framework of 8 cognitive traits that we would want to see people shift in— situational awareness, critical thinking, attachment, threat perception, motivations, bias, and a few others. But if I had to condense that down to one thing, it's trust. So, how we have zero trust infrastructure, like technology, and we're trying to move towards zero trust, we are currently working on the concept of of building a zero trust mindset. Because a lot of what happens right now is because of how easily we take what we see as the source of truth online, not just as an email, but even as content, even as misinformation, all that good stuff, right? I think if we can create and show a change in people's level of trust in technological interactions, not technology, technological interactions, and we can decrease that, maybe hopefully increase it with other humans in the physical world. I think that that would be a core metric that would start solving a lot of problems. I think automatically people will slow down in their response time. People will not make rash decisions and will not believe what they've seen or what they hear without reanalyzing it a little bit.

So measuring the levels of misplaced trust, the higher you are, the more susceptible of doing bad things, the more vulnerable that you are to all sorts of different manipulations and making those mistakes manifesting in insecure behaviors. Last question real quick for each one of you. Again, you know, the listeners in this podcast, a lot of them are cybersecurity professionals, leaders, CISOs, things of that sort. If you could tell them one thing for them to go forward now that would help them make the human risk factors of their organization more robust or more mature or less trustworthy by default, what would that one thing be? And I'm going to start with you, Ashley.

Oh, I mean, it's, it's an easy one to say, hey, go pursue a human risk management strategy. But that is very verbose. You know, I would say, like, go get visibility into your human risk factor. Get beyond completion compliance rates and phishing click. You need to look at actual behavior. You need to look at the threat vectors. You need to look at identity and access levels. So, prioritize your people, just like you do the rest of your security stack.

All right. Shamona, what's the one thing you want security professionals to do here?

Ah, this is a hard one.

I mean, drink more coffee is an available answer. It is on the board.

Mincey, trying to keep myself extra hydrated. Um, I would say create space in the conversations and in the solutions that you're looking into to really, um, open up to behavioral risk management platforms like what Living Security is doing and the whole of cyber psychology and around cybersecurity, because understanding how this field works and how these solutions work, I think will change a huge part of the paradigm on how decisions are made around security within the company. So even if that means reading about it a little bit more, understanding, talking to people a little bit more about it, bringing those conversations in, into those roundtable discussions and executive discussions to just get a different perspective. I think that's a good first step.

And for Wade, I'm going to change it up just a little for you because I don't want it to be easy.

Man, I had all that time to think of a wonderful answer. You did. And I'm going to just take that from you. No, I can't share it.

I'm sure it would be profound, but yeah, I don't care. The question for you kind of along the same lines for the security professionals out there, what data data should they be looking at to better understand the human risk factors? We've got tons of data on the technology side, right? Probably far too much, and that's a bias in and of itself. What data should they be gathering, doing analysis, or sharing with the industry to help tackle this problem?

Yeah, a couple different levels here. One, help the industry. I'm always advocating. I just really wish there better, um, and more transparent reporting of incident information. I'm not saying you have to go out yourself and all—

So you're advocating for more data breaches. That's what you're saying?

I am advocating for greater sharing of breaches, near misses, other kinds of incidents, because I think that does help the industry understand, tailor controls, set policies and priorities and all of those kinds of things. And I, I think we do it when we have to, but we could learn a whole lot more from near misses, incidents that aren't regulated or, or, you know, all of that kind of stuff. So I, I, I wish, I, I've always wanted a way for, for that to happen and, and be palatable. I realize that that's a big, big lift. On the internal side, I actually had my eyes opened in doing this study with Living Security about the, amount and diversity of data that is available to measure different aspects of human risk. Again, because I've— we've done this kind of thing before, and you think about the easy ones, right? Oh, we can measure phishing emails and click rates. And yeah, that's great. Let's, let's do that. But there's so much out there. And if you just sort of take some time and, you know, I think I would go back to— this would be my call as, hey, you should go do this. Take some time and decompose every single aspect of human risk that you can possibly think of in your organization. Like, what are all the What are all the possibilities out there? And then how might you measure that and know if it's going on in your organization? Just a thought exercise. You know, it might, might even be good training for your people just to walk through all of that. Can we see this? Can we not? How well? How would we see it? What would we need to add? Where are we blind? All of those kinds of things. And I think, I think that's a very helpful— I don't think that all organizations can measure all aspects of that right now. They don't have the data. But if you organize it and keep a catalog of where you're blind, then that can lead, all right, we've gotta do something there. I think would be a very healthy place to start and also would be enlightening in terms of potential data sources to understand the problem better.

I wanna add two, two things. I know we're about to wrap up. In the back of the report, which I think we'll probably link to, we have a link to what we're launching as a human risk management framework. So, it's gonna be like open source. We're looking for industry feedback, um, on it as well. But exactly what Wade just talked about, we are listing essentially like insight taxonomy of all the different things that you could measure on human risk. And so, we wanna like provide that to, to the industry. Like you can get started without a platform, like just go start looking at your data sources and, and see where your gaps are. So, definitely wanna provide that as a resource. And then Wait, I think there is an interesting combination, probably be between what Shimona's research is doing and living security of being able to start correlating those, the cognitive behavioral factors, and then what we're actually seeing within the actual behavior within the, the organization and some of these other pieces. So we're gonna have to do like a follow-up, uh, Scientia report, I think, doing some cross-correlation.

I actually really loved your, the axis of vigilance risk. Risky, Lawful, and Chaotic. And like, as soon as I read that, I'm like, oh my God, the framework that we are working on can literally— like, there is, there is good, there's a beautiful synergy. And the, um, the correlation between what makes someone Vigilant, Risky, Chaotic, and how that moves— I would be very curious to see the correlations between— yeah, there we go. Yeah, this was so interesting, and I would love to see like how that correlates to the cognitive traits. Because again, this is a new field. I'm just starting my PhD in it too. Um, there's a lot of, there's a lot of, um, uh, exploration between this framework, I think, and the field of cyber psychology. So super excited.

Yeah, I would throw one more thing in as my ask, because I know the industry is moving in a great direction and looking at the end users and the potential risks that they represent. My ask in the future is to do the exact same thing for the threat agents themselves because I believe there are avenues that we can move as an industry that can actually undermine, can leverage the cognitive and behavioral vulnerabilities and motivations and everything else of the attackers and use that against them. And when we talk about scale, that's where we can have actually massive, massive impact. So as you come up with this taxonomy, I also wanna, at least in the back of your mind, be thinking, how can we also apply this to characterize the bad agents and what they're doing? Because we may be able to dissuade, deter things of that sort to avoid risk and loss.

Yeah. So we are, we are starting to look at agentic AI, so agent behavior. That's gonna be the, the kind of expanded area that we're going. But yeah, looking at the, the attackers is certainly an interesting and big challenge to undertake.

And it's sexy. So yes, this is, this is good. Wade Baker, the co-founder of Cyienta Institute, providing absolutely the best cyber risk research and quantification. Ashley Rose, CEO and founder of Living Security, a leader in human risk management. And Shimona Banerjee, the founder of MindShield Institute, which is focused on the protection from cognitive threats. I wanna thank you all for sharing your cybersecurity insights with us today. And I am gonna put that link, Risky Business, the State of Human Cyber Risk Report, I'll put it in the description for anybody that wants to go in there and download it so everybody can have it. But I wanna say thank you all for sharing your insights.

Appreciate it.

Thank you, Matthew.

Yeah, thank you.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders and Wade to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.