The Language of the Business: Applying Behavior Science for Risk Management
summary
Risk management is a psychological problem: relationships and communication determine whether controls stick. Cited study of ~5,000 respondents across 20–30 countries shows mature capabilities are >2x likely to report good executive and peer relationships. Practical tactics: use a risk menu of 10 concrete scenarios, reduce ambiguity (state knowns/unknowns), make initiatives interesting (tie data governance to Copilot adoption), schedule reinforcement at 6–12 week intervals, and bake controls into the lifecycle with tooling/telemetry so compliance is observable rather than assumed.
AI-written summary · about
chapters (10)
- 0:00Human-centered risk management
- 3:07Cybersecurity Man debunked
- 6:57Risk appetite and relationships
- 11:53Making security engaging
- 15:05Cognitive biases in risk
- 21:44Risk thermostat and behavior
- 26:37Communicating risk
- 32:58Sustaining security culture
- 38:18Why awareness training fails
- 45:00Final thoughts
related talks
29mManaging Risk with Psychology Instead of Brute Force
48mRisk Management: Hindsight is 2020
26mThe Risky Business of Risk Illiteracy (Sean Juroviesky)
46mBusinesses Run On Risk And Debt: Why Communicating Security Risk Is Hard
36mNot Your Mama's Risk Assessment
28mHow to Tell the Right Cyber-Story to Executives and Board Members
52mRisky Business: Managing Risk across Industries in Today's Global Economy
31mThe psychology of security: Why we make mistakes