Kat Sweet = Rethinking Role Based Security Education

### The Failure of Universal Security Training At 00:00, Kat Sweet (Duo Security) critiques traditional corporate security awareness training, highlighting the shortcomings of annual, one-size-fits-all compliance modules. Employees across different departments face completely distinct operational environments, making universal training ineffective and forgettable.

### Segmenting Curricula by Departmental Threat Models At 08:00 and 16:00, Sweet advocates for role-based security education tailored to specific organizational workflows. Developers require instruction on threat modeling, secure code design, and dependency management; finance teams need training to identify Business Email Compromise (BEC) and wire fraud pretexts; and HR personnel require guidance on malicious resumes and weaponized document macros.

### Fostering Departmental Security Champions At 24:00, the presentation explores building security champion networks. By identifying interested employees within business units and training them as security advocates, organizations create direct communication channels between technical security teams and operational departments.

### Measuring Behavioral Culture Over Compliance Rates Concluding between 32:03 and 40:03, Sweet emphasizes modern defensive metrics. Rather than celebrating 100% compliance test completion, security leaders should measure meaningful behavioral shifts—such as how quickly staff report suspicious messages, request threat reviews for new projects, and engage collaboratively with security personnel.

(AI summary — Gemini Flash)