Security Awareness and Culture Building
Annual compliance training that nobody remembers a week later isn't security awareness, it's a line item for an auditor. The organizations that actually reduce their human-risk exposure aren't the ones with the slickest training videos, they're the ones where people feel safe reporting "I think I clicked something bad" without getting yelled at, and where the training reflects the specific ways their people actually get targeted.
I think of awareness work in two layers. The first is the baseline: making sure people can recognize phishing, understand why MFA matters, know what to do with a suspicious attachment, and know who to call. That part is necessary but it's not where the real risk reduction happens. The second layer is culture: whether people treat security as something IT does to them or something they're part of, whether reporting a mistake is safe, and whether leadership visibly treats security as a real priority rather than a slide in the all-hands deck.
How I approach it
I start by figuring out where your actual exposure is, not by assuming every company's risk looks the same. A law firm's biggest human-risk vector is usually business email compromise targeting wire transfers and client trust accounts. A healthcare practice's is usually credential phishing against EHR access. I build scenarios and training content around what's actually likely to hit you, run realistic phishing simulations that mirror those threats, and track whether behavior is actually changing, not just whether people clicked through a module.
I also pay attention to the incentive structure. If someone gets publicly shamed for falling for a simulated phish, they stop reporting real ones. I'd rather build a program where the first instinct when something looks off is to forward it to security, not to quietly hope it goes away.
Who needs this
If your current training is a once-a-year video nobody watches past the first screen, if you've had a close call with a phishing attempt and want to know how exposed you really are, or if an insurer or auditor is asking what your awareness program actually looks like beyond a checkbox, this is worth a conversation.
Reach out and tell me where your team's weak spots are, or where you suspect they might be.