Behavior Design for Security Programs
A masterclass on applying behavior-design principles to security programs — the small set of mechanisms that actually move human decisions at the moment they matter. Covers why awareness training alone fails to change behavior; how nudges, friction, defaults, and salience shift decisions without reliance on willpower; the social dynamics of compliance versus commitment; the role of leadership behavior as the loudest signal employees observe; and the metrics that distinguish behavior change from awareness delivery. Part of The Human Factor Masterclass Series.
What you'll learn
- Explain the knowledge-behavior gap in security — why employees who can recite the rules nonetheless break them — and the implications for program design.
- Identify and apply the four core behavior-design mechanisms — nudges, friction, defaults, and salience — in the specific context of security decisions.
- Design security into the moment of decision rather than before or after, using the chokepoints that already exist in the systems your workforce uses daily.
- Distinguish compliance from commitment as organizational outcomes, and understand the social dynamics that produce each.
- Recognize leadership behavior as the loudest signal in your workforce, and audit your own and your executives' observable behaviors against the signals you intend to send.
- Replace awareness metrics with behavior metrics, and build a measurement program that reveals real change rather than confirming activity.
Requirements
- Appropriate for security program leaders, security awareness and culture program owners, learning-and-development leaders partnered with security, and HR leaders responsible for workforce behavior change.
- No prerequisite courses; completion of CS-303 (Security Culture: A Leadership Masterclass) provides useful cultural context.
- Audio or captions enabled so you can follow the narrated video for each module.
Course content
7 chapters · 6 lectures · 1h 29m total
Module 1 — The Knowledge-Behavior Gap
Why employees who can recite the rules still break them, and why that gap is a feature of human cognition rather than a failure of the workforce. The implications for how we design programs that intend to change what people actually do.
1 item
Module 1 — The Knowledge-Behavior Gap
Why employees who can recite the rules still break them, and why that gap is a feature of human cognition rather than a failure of the workforce. The implications for how we design programs that intend to change what people actually do.
-
The Knowledge-Behavior Gap Free preview15 minutes
Module 2 — The Behavior-Design Toolkit
The four mechanisms that reliably shift decisions at the moment they are made — nudges, friction, defaults, and salience — and the specific texture of each in the security context.
1 item
Module 2 — The Behavior-Design Toolkit
The four mechanisms that reliably shift decisions at the moment they are made — nudges, friction, defaults, and salience — and the specific texture of each in the security context.
-
The Behavior-Design Toolkit15 minutes
Module 3 — Designing Security Into the Moment of Decision
Why timing is the most-neglected variable in security program design, and how to locate and use the chokepoints already present in your workflows to intervene at the moment a decision is being made.
1 item
Module 3 — Designing Security Into the Moment of Decision
Why timing is the most-neglected variable in security program design, and how to locate and use the chokepoints already present in your workflows to intervene at the moment a decision is being made.
-
Designing Security Into the Moment of Decision14 minutes
Module 4 — Compliance Versus Commitment
The two different organizational outcomes a security program can produce — compliance and commitment — and the social dynamics that produce each. Which to pursue, when, and how to tell them apart.
1 item
Module 4 — Compliance Versus Commitment
The two different organizational outcomes a security program can produce — compliance and commitment — and the social dynamics that produce each. Which to pursue, when, and how to tell them apart.
-
Compliance Versus Commitment15 minutes
Module 5 — Leadership Behavior as the Loudest Signal
What executives are observed doing, not what they say, is the loudest signal in an organization about which behaviors are valued. How to audit observable leadership behavior and align it with the signals you intend to send.
1 item
Module 5 — Leadership Behavior as the Loudest Signal
What executives are observed doing, not what they say, is the loudest signal in an organization about which behaviors are valued. How to audit observable leadership behavior and align it with the signals you intend to send.
-
Leadership Behavior as the Loudest Signal15 minutes
Module 6 — Measuring Behavior, Not Awareness
Why the dominant metrics in security awareness programs measure activity rather than behavior, and what a behavior-measurement program looks like. The common traps — gaming, phishing-simulation theater, vanity metrics — and how to avoid them.
1 item
Module 6 — Measuring Behavior, Not Awareness
Why the dominant metrics in security awareness programs measure activity rather than behavior, and what a behavior-measurement program looks like. The common traps — gaming, phishing-simulation theater, vanity metrics — and how to avoid them.
-
Measuring Behavior, Not Awareness15 minutes
Final Assessment
A 12-question scenario-based assessment on behavior design. Scenarios test application of the frameworks, not recall. You need 80% or higher to pass. Unlimited retakes.
1 item
Final Assessment
A 12-question scenario-based assessment on behavior design. Scenarios test application of the frameworks, not recall. You need 80% or higher to pass. Unlimited retakes.
-
Final Assessment — Behavior Design for Security Programs