Positive Reinforcement & Gamified Security Awareness | Interview with Craig Taylor

In this episode of the Secure and Simple Podcast, host Dejan Kosutic (CEO at Advisera) interviews Craig Taylor, CEO and co-founder of CyberHoots, about best practices and myths in cybersecurity awareness training. Taylor argues the industry’s biggest mistake is relying on punishment, shame, and deception-based phishing tests, saying psychology supports positive reinforcement and rewards to increase desired behaviors. He recommends teaching a clear phishing rubric, practicing in a browser-based environment rather than trick emails, using gamification such as levels and leaderboards, and fostering a safe culture where employees report mistakes quickly. The discussion covers short, frequent training content, useful KPIs like compliance and reporting, cautions about incentives, examples of real incidents, and how AI may increase breaches before security improves while human social engineering remains a key risk.Links from the episode: - Conformio software to streamline and scale ISO 27001 implementation and maintenance for your clients: https://advisera.co/Conformio-software- White label documentation toolkits for NIS2, DORA, ISO 27001, and other ISO standards to create all the required documents for your clients: https://advisera.co/page-all-toolkits - Accredited Lead Auditor and Lead Implementer courses for various standards and frameworks to show your expertise to potential clients: https://advisera.co/Consultant-Courses- Company Training Academy with numerous videos for NIS2, DORA, ISO 27001, and other frameworks to organize training and awareness programs for your client’s workforce: https://advisera.co/page-Company-Training-Account  - Beginner's Course for ISO, Cybersecurity, and AI Consultants: https://www.youtube.com/playlist?list=PLHwD3nQun7caKFq80LxNNYKIabATlyA7t- How to Grow Your Cybersecurity, ISO, or AI Consultancy: Advanced Course:https://advisera.co/GrowYourConsultancyTraining  (00:00) - Interview with Craig Taylor (01:04) - Myth Of Punishing Clicks (05:05) - Why Fake Phish Backfires (11:28) - Tests After Training (13:25) - Culture Of Safe Reporting (16:47) - Real Incident Story (20:00) - Changing Culture With Incentives (23:25) - Gamification Beyond Leaderboards (26:07) - Training Formats And Cadence (31:04) - Metrics And KPIs That Matter (37:06) - Future Of Awareness And AI (42:54) - Resources for Security Professionals