The behave hub

11 things RSA 2026 told us about the human side of cybersecurity

RSA 2026 made one thing clear: the human risk problem is accelerating faster than our ability to patch it. Here are 11 takeaways from the floor.

The anatomy of human risk

Security risk isn't just about attackers; it’s about pressure, friction, and the human behavior at the core of every control. Discover a new model for HRM.

You keep saying “the human side of cybersecurity.” Which one do you mean? (There are six.)

A common security phrase is slippery. CybSafe CEO Oz Alashe explores the “human side of cybersecurity” and outlines six ways people use the term

Raise the bar: 50 creative Cybersecurity Awareness Month ideas

The search is over! Our Cybersecurity Awareness Month guide is packed with ideas, examples, insights, and resources. Time to shine bright and make an impact.

Why “we already have that data” is bullsh*t

CybSafe’s CEO and founder Oz Alashe unpacks why your colleagues keep missing the point on behavioral risk – and what to do about it

What is Human Risk Management?

Human risk management (HRM) is a modern approach to solving workforce-related cyber challenges. It uses data to identify risky behaviors in real time and applies automated, personalized interventions to reduce the likelihood and impact of cyber incidents caused by people.

Understanding the UK Online Safety Act: Duties to protect children - now enforceable!

The UK Online Safety Act (OSA) is a landmark piece of legislation in the UK that is reshaping the digital landscape. It places a new "duty of care" on online platforms to protect their users from harmful content. It brings us one step further on CybSafe’s mission of making the internet a safer digital place. Here’s a summary of what the new law means for user safety and what it signals for the future of online platforms.

Wake-up call: the human element in the UK retail cyberattacks

The digital landscape has been buzzing with news of cyberattacks rocking the British retail sector. For many organisations, these headlines haven't just been news; they've been a stark, cold splash of reality, highlighting a threat that's not lurking in the shadows, but actively knocking at the digital door. The heightened alert around ransomware and other malicious cyber activities isn't just paranoia – it's a direct response to events that have tangible consequences. We're talking about significant financial losses, the erosion of hard-earned brand trust, operational paralysis, and the deeply concerning theft of sensitive data.

Tool or infrastructure? Why it matters for HRM

Most people in your position don’t recognize the difference between a tactical tool and strategic infrastructure. Or, to put it another way, between a point solution and a platform. Did we mention that this distinction really matters? Anyway, let’s get to the point (solution).

NIS2: Beefing up security for critical industries

So, you’ve probably heard whispers (or maybe full-blown announcements!) about this thing called NIS2. But what exactly is the NIS2 Directive, and why should you care?

The BEHAVE newsletter – All issues

The Behave newsletter, all editions. Human cyber risk? Measured. Behavioural science insights, delivered.

An open letter to CISOs & Security Leaders

The human side of cybersecurity is evolving. Fast. But there’s a good chance you might be stuck in the past.

Why security awareness still isn’t taken seriously (and how to fix it)

Let’s start with a painful truth: Security awareness, culture, and human risk professionals are often undervalued. Despite the rising threat of human-enabled cyber attacks, many organizations still treat addressing the human aspect as a checkbox.

Security metrics reboot: Less input, better output, real outcomes

Explaining the difference between inputs, outputs, and outcomes. Here’s the quick and simple way to break it down.

CybSafe book list: Books on the human aspect of cybersecurity, human risk management, security awareness, or security culture

Below are a selection of books written by authors who specialise in the human aspect of cybersecurity. Recommended reading for anyone who wants to specialise in this field or deepen their expertise.

Security awareness/security culture/human risk management specific job titles

This isn’t super scientific but we’ve been keeping tabs on ABC/HRM-specific job titles over the years.

How to increase the perceived value for what you do to manage human cyber risk

Security professionals often struggle to quantify and communicate the business impact of human cyber risk management. Below is a comprehensive list of real-world examples demonstrating how human cyber risk initiatives align with core business priorities.

The dogma of security awareness: Exposing cybersecurity’s biggest blind spot

This piece takes aim at “security awareness dogma”. You have been duly warned.It exposes why, despite good intentions and evidence to the contrary, most security leaders and security professionals remain closed-minded to the reality of the human aspect of cybersecurity.

Maximizing security awareness engagement: How the pros do it

The top mic-drop insights from our Cybersecurity Awareness Month engagement webinar. We assembled a uniquely expert panel with diverse backgrounds and roles. We invited them to spill their victories, wisdom, and yes, mistakes…all so they could help you detangle the engagement enigma.

Can BS make SA&T stick? Hot takes from the experts…

Using insights from “Oh, Behave!” to strengthen security training and drive lasting behavioral change. To arrive at the most useful answers, we hosted a webinar featuring a panel of indisputably impressive industry-leading experts.

How to talk like a human risk manager: Unleashing the language of credibility

Our recent thought-provoking webinar explored the power of words, the nuances of risk, threats, and vulnerabilities, and how being versed in this language can elevate your role as a human risk manager.

Maturing SA&T programs into human risk management strategies: The why, the how, and the expert wisdom

You know that feeling when something can’t keep up with the pace of modern life? That’s exactly where we are with traditional Security Awareness & Training (SA&T). It’s outdated, clunky, and struggling to stay relevant. In a recent CybSafe webinar, Jinan and CybSafe’s CEO, Oz Alashe, broke it all down: Why SA&T falls short (and has been for years); How HRM is different; How to begin the shift from SA&T to HRM in your organization.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

Oh, Behave! provides unmissable insights into people’s cybersecurity behaviors and attitudes, along with data-driven recommendations for businesses, policymakers, and individuals looking to manage human risk and strengthen their cybersecurity.

The GenAI story isn’t just about technology. Here’s what’s at the heart of it.

The numbers don’t lie: Overwhelm and frustration with security measures are causing people to take more risks online. So how can you re-engage and empower users?