Are You Killing Your Security Program?

### Rethinking Human Risk and Security Awareness Metrics At 00:00, Michele Fincher, Chief Influencing Officer at Social-Engineer LLC, addresses why well-intentioned enterprise security awareness programs frequently fail to improve resilience. Fincher warns that treating human vulnerability through simplistic phishing click rates creates misleading metrics and damages employee relations.

### The Dunning-Kruger Effect and Cognitive Bias in Training At 07:25, Fincher discusses cognitive biases affecting security personnel. She explains how the Dunning-Kruger effect causes technical staff to overestimate their understanding of human behavior, leading to patronizing training modules that foster resentment rather than positive security habits.

### Diversity, Culture, and Communication Dynamics At 14:58, the presentation examines how workforce diversity impacts communication. Employees from diverse generational, cultural, and linguistic backgrounds process authority, social cues, and deceptive solicitations differently, requiring adaptable security outreach rather than one-size-fits-all training.

### Avoiding Punitive Cultures and Decision Fatigue At 22:20, Fincher highlights how punitive responses to simulated phishing tests backfire. Disciplining employees who click test links creates a culture of fear, leading staff to hide actual security incidents rather than reporting them to security teams.

### Cultivating Psychological Safety and Positive Reinforcement Concluding between 25:00 and 29:10, Fincher advocates for shifting security culture toward psychological safety. By rewarding employees for reporting suspicious activity and designing frictionless reporting workflows, organizations turn their workforce into active defensive sensors.

(AI summary — Gemini Flash)