How cyber risk actually shows up in real work — and why awareness alone isn’t enough

I spend most of my time working with organisations on cybersecurity training, but the work rarely starts with tools, policies, or compliance frameworks.

In practice, most cyber incidents don’t come from a lack of rules or technology. They come from everyday situations where people are under pressure, juggling competing priorities, making decisions quickly, or working around systems that don’t quite fit how the job is done.

The gap isn’t usually knowledge. It’s context, support, and design.

That’s the perspective I bring into conversations, whether that’s on a podcast, in an article, or as part of a wider discussion. The focus is always on what’s actually happening in real environments, and why the same patterns tend to repeat.

What I tend to talk about

My work sits at the intersection of cybersecurity, education, psychology, and workplace culture. Rather than treating cyber risk as purely technical, I explore how it shows up in everyday work and decision-making.

A recurring theme is why traditional awareness training often increases confidence without improving behaviour. I spend a lot of time unpacking the idea of “human error” — not as a cause, but as a symptom of how systems, expectations, and pressure interact.

I also explore cybersecurity as a cultural and leadership issue, and increasingly as a safeguarding issue in environments where trust and responsibility are closely connected.

— Why awareness doesn’t translate into behaviour in real work
— How urgency, fatigue, and cognitive load shape decision-making
— Why well-intentioned controls can create unintended risk
— How organisations can move from awareness to understanding in practice
— Cybersecurity as a safeguarding and leadership issue

At the centre of this is a simple question: what actually helps people make better decisions over time — and why do some approaches consistently fall short?

What this looks like in conversation

The focus is not on scare stories, vendor comparisons, or promoting tools. It’s on making complex ideas understandable and grounded in real situations.

Conversations tend to be practical, calm, and focused on helping people recognise patterns they’ve already seen in their own work. The aim is not to create urgency, but to create clarity.

That often leads to more useful discussions, because people can see how the ideas apply directly to what they’re already experiencing.

Examples of recent work

These pieces reflect the themes I most often explore in conversation.

Beyond Awareness: Why Cybersecurity Training Must Become Behaviour-Led (White Paper)
A deeper exploration of why traditional awareness-led approaches struggle in real environments, and how behaviour, decision-making, and context shape cyber risk in practice.

Where Awareness Fails: Why Cybersecurity Training Isn’t Stopping Breaches
Examines why awareness alone doesn’t translate into safer behaviour, and how everyday decision-making under pressure allows risk to persist across organisations.

From awareness to understanding: the hidden cost of falling behind modern cyber expectations
Explores why awareness-led approaches struggle in modern environments, and how organisations often mistake familiarity for genuine understanding.

What is human-first cybersecurity?
Looks at how systems, culture, and pressure shape behaviour, and why reframing the problem changes how organisations approach risk.

Understanding the 4 C’s of online safety: a practical guide for schools and trusts
Explains where online safety and cyber awareness break down in real environments, particularly in education and safeguarding contexts.

Let’s connect

If you’re planning a podcast, article, or discussion and want a practical, human-first perspective on cybersecurity, I’m always happy to contribute.

We can shape the conversation around your audience and the challenges they’re already facing, so it feels relevant and useful rather than theoretical.

No pitches, no hype. Just clear, grounded conversations.