Leveraging Human Risk Data to Strengthen Cyber Resiliency
summary
Claims a dataset of 4.5 million employee security decisions across ~114,000 people and shows actionable results: non‑contractors and first‑line managers click phishing links most; phishing clicks peak early morning and late afternoon; late training completion predicts ~5% higher click rates. Recommends measuring real user behavior, applying targeted controls (more monitoring or blocks for risky identities), tailoring simulated phishing to attacker timing, and rewarding reporting to reduce incidents and shrink cleanup load.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:37What You Will Learn
- 2:02Security needs to be built on solid fundamentals. People are part of your fundamentals
- 5:23What does it mean to have a cyber resilient workforce?
- 9:36How to defend forward
- 11:46What is "human risk?"
- 13:10Understand Employee Risk Through Past Decisions
- 14:26Establish an individual's security reputation
- 16:28Demographics matter
- 20:13Can we measure security culture?
- 21:40Late Training Completion Signal Poor Security Performance
- 24:30Transparent communications to employees to let them know where they stand and how to get better
- 26:58Benchmarking departments to identify areas of strength and need for improvement
- 28:10Setting Controls At Scale
- 29:07Thinking beyond the lowest common denominator
related talks
54mEmployees Are the New Perimeter- How the Pandemic Shaped Workforce Risk
53mRisk Profiles: Why Some Employees Attract Danger and Others Dodge It
41mHuman Vulnerability Management and Assessment in the Age of Zero Trust
30mGetting Engagement in the Midst of Chaos
27mBlunting the Phisher's Spear: A Risk-Based Approach...
01h 07mKeynote Presentation Blinded by “the weakest link” A New Perspective on Human Risk
51mSecurity's Holy Grail: Predicting Attacks Before They Happen
52mWho Says Cybersecurity Can’t Be Creative?