Practical perspectives on human cyber risk, evidence-based simulation measurement, explainable employee threat reporting, and adaptive micro-learning. Written for the security teams who must turn security awareness into an accountable operating program.
Phishing click rates measure a single interaction. They leave out recipient coverage, automated mail scanners, reporting velocity, and whether learning changed subsequent decisions.
{
"total_delivered_population": 4100,
"eligible_active_recipients": 3840,
"excluded_out_of_office": 260,
"automated_gateway_clicks": 568,
"verified_human_interactions": 161,
"protective_reports_submitted": 2465,
"first_protective_report_latency": "42s",
"credential_compromise_rate": "1.8%"
}[00:00.000] ATTACK_DELIVERY :: 1,200 targeted finance emails delivered
[00:00.042] FIRST_REPORT :: Employee flags suspicious IBAN routing
[00:01.115] SOC_ALERT_RAISED :: Triage engine correlates SPF and reply-path
[00:04.300] FLEET_QUARANTINE :: 1,192 unopened messages removed from inboxes
[00:45.000] ADVERSARY_WINDOW :: Attacker exfiltration attempt thwartedASSESSMENT_CYCLE:
- Phase: Initial Simulation Exposure (Vendor invoice pretext)
- Action: Just-in-Time micro-learning completed at interaction moment
- Reassessment Day 14 (Identical Template): 89.4% (Template recall)
- Reassessment Day 14 (Novel Pretext, Same Vector): 84.2% (True habit transfer)
- Reassessment Day 60 (Comparable Conditions): 82.0% (Sustained resilience)Research Pillars
Moving away from compliance checkboxes requires restructuring how organizations measure simulation interactions, how SOC teams triage reported threats, and how awareness builds lasting defensive habits.
Replace "people are the weakest link" with specific, testable decisions, contextual verification, and structured review cycles.
Read Field Note 01 Pillar 02 // Threat TriagePreserve employee context, separate authentication from legitimacy, isolate facts from inferences, and make uncertainty actionable.
Read Field Note 03 Pillar 03 // Surface CoverageConnect email phishing, QR quishing, SMS smishing, and voice callbacks under a consistent, testable learning objective.
Read Field Note 04Interactive Research Workbench
Filter by research domain or keyword to preview core theses, key takeaways, implementation checklists, and connected platform modules.
Interactive field note inspector with live category filtering.A practical definition of human risk management and a connected operating model for security teams.
“People are the weakest link” is a poor operating model. It says nothing about the situation, the control environment, or what a person needs to do differently. Security teams need specific, testable objectives that connect evidence with targeted interventions, followed by verification of behavioral change.
Simulation Telemetry + Protective Reporting Velocity + Targeted Learning Retention = Defensible Human Risk Model
The Complete Collection
Every guide is grounded in empirical defense operations, clear metric definitions, and zero vendor hype.
5 field notes
A practical definition of human risk management and a connected operating model for security teams.
How to interpret phishing simulation results with coverage, automated activity, reporting behavior and comparable reassessment.
A framework for reviewing sender identity, authentication, message intent, URLs, attachments, reputation and uncertainty.
Connect email phishing, quishing, smishing, vishing and messaging scenarios to meaningful learning objectives.
A practical model for targeted security awareness, meaningful assessment, multilingual learning and reassessment.
No field notes match. Try another topic or clear your search.
Methodological Principles
Field-tested operational guidelines that separate evidence-led risk management from vanity compliance.
Reassess defensive behavior under comparable difficulty and novel pretexts. Testing identical templates measures superficial memorization rather than transferable resilience.
Always disclose total delivered populations, active recipients, and excluded leaves alongside any interaction metric. A percentage rate without a clear denominator is uninterpretable.
Isolate automated link crawlers, URL sandboxes, and mail gateway detonators from human interaction events. Failure to filter bot clicks distorts risk assessments by up to 300%.
Deconstruct reported email analysis into verifiable observations (headers, SPF/DKIM, routing) and distinct analytical inferences. Never conceal uncertainty behind an opaque verdict.
Deliver focused, non-punitive guidance at the exact moment of exposure. Contextual lessons anchored to the specific attack cues produce significantly higher retention than disconnected annual training.
Enforce zero model training on customer data, ephemeral in-memory processing, and sovereign human sign-off gates. Human risk telemetry must remain cryptographically isolated and auditable.
The National Institute of Standards and Technology emphasizes in Special Publication 800-50 Rev. 1 (Building a Cybersecurity and Privacy Learning Program) that effective security programs must progress from passive awareness to measurable behavioral change and continuous program evaluation.
Let’s connect the dots
Bring your awareness program, your reporting workflow, or the question your current metrics cannot answer.
Book a demo