Awareness Isn’t the Problem: Why Environment Design Drives Human Cyber Risk

Why do human driven cyber incidents keep repeating, despite years of awareness and training? Because most security decisions are not made in classrooms. They are made under pressure, in poorly designed processes, with tools and workflows that quietly reward insecure behavior. This session challenges the awareness only mindset and introduces a practical shift in human risk management: designing operational environments where secure behavior becomes the easiest path, not the hardest one. Through real world examples, you will learn how processes, systems, and constraints shape behavior at scale. The focus is not on perfect programs, but on how to spot high risk moments and redesign conditions so people can do the right thing by default. Awareness informs. Training guides. But the environment decides. In this session, you will learn how to: • Identify the most predictable human attack surfaces and how everyday environments create them • Redesign processes and systems so secure behavior becomes the easiest, default choice • Combine awareness, training, and environment design into a scalable strategy for measurable human risk reduction