You Can't Patch a Human: Security Awareness as a Behavioural Science with Lucy Finlay

Security awareness has spent years stuck in the same loop, annual training, phishing simulations, completion rates. Budgets are tight, compliance is the priority, and the dial on actual human behaviour barely moves.Lucy Finlay has spent nearly a decade in the security awareness space, and her argument is simple: the industry has been treating people like machines you can update with a policy and a phishing simulation. It doesn't work. And the data backs her up.In this episode, Lucy, who built her career through marketing, languages, and people engagement before spending seven years leading security education at Aviva, makes the case that security awareness is fundamentally a behavioural science problem, not a compliance one.We get into why context is everything when it comes to how people retain information, why click rates are the wrong thing to measure, and how the COM-B model can help you identify the real reason your programmes aren't landing. Lucy also talks through what it actually looks like to segment your audience, how to make the case for more resource, and why security awareness professionals should be in the containment phase of an incident, not cleaning up afterwards.Whether you're a CISO questioning your current approach or a solo security awareness practitioner trying to do more with less, this one is worth your time.