Most organizations measure security culture through surveys, phishing simulations, and training metrics. While useful, these approaches often miss something critical: why employees make the decisions they do. Without understanding the underlying type of security culture in an organization, interventions can feel generic, misaligned, or ineffective.
This session introduces a practical, behavior-focused approach to measuring security culture using Situational Judgment Tests (SJTs), paired with other lightweight methods practitioners can apply in their own environments. SJTs present realistic scenarios and ask employees how they would respond, revealing patterns in decision-making that traditional metrics overlook. The result is a clearer picture of how security is actually understood, prioritized, and acted upon across the organization.
Using real-world examples from a global energy firm, this talk will highlight how different cultural patterns shape employee responses to security expectations and initiatives. Attendees will gain insight into how these patterns influence behavior in ways that are not visible through traditional metrics alone.
This session is not about adding another measurement tool. It focuses on shifting how we think about security culture, from something we broadly assess to something we can diagnose and act on. By the end of the session, attendees will understand why measuring the type of security culture matters, how to begin identifying it within their own organization, and how those insights can be used to better target interventions, training, and communication strategies.
Whether you are leading a security program or designing awareness efforts, this session will provide a practical starting point for moving beyond surface-level metrics toward more meaningful, behavior-driven insights.
