Every time a breach hits the headlines, the same questions appear:
Who clicked what?
Which system failed?
Why wasn’t the patch applied?
But underneath all of that sits a much quieter truth – one that most cyber professionals nod along to privately:
Most organisations don’t have a cyber security problem.
They have a culture problem.
And culture shows up in subtle ways long before a breach ever does.
People aren’t reckless – the systems around them are awkward
When someone works around a security control, nine times out of ten it’s not because they don’t care. It’s because they’re trying to get their job done and the “secure way” makes it harder.
Slow VPN?
People bypass it.
Clunky MFA setup?
People delay it.
Confusing policies?
People guess.
Shadow IT doesn’t appear because staff are rebellious – it appears because the tools they’re supposed to use don’t match how they actually work day-to-day.
Security still feels like a risk, not a support
Ask someone why they didn’t report something suspicious and you’ll usually hear:
“I didn’t want to cause a fuss.”
“I wasn’t sure.”
“I thought I’d get blamed.”
That’s a culture problem – not a cyber one.
If reporting feels scary, attackers get a bigger window. The quicker someone puts their hand up, the quicker the organisation can respond.
Tick-box training creates tick-box behaviour
Most places can produce a spreadsheet proving “everyone completed their annual cyber training”.
But if you ask people what stuck… it’s usually not much.
Good culture makes learning feel normal, not an annual chore. It becomes part of how people talk, how they share stories, how they make decisions.
Secure behaviour should be the easiest behaviour
This is the heart of it.
If you design processes, tools, and expectations that support how people actually work – secure behaviour becomes natural. You don’t need fear-based posters or blame-laden language.
Instead you get:
staff who flag something early without hesitation
teams who use approved tools because they’re actually usable
leaders who make decisions with risk in mind, not as an afterthought
MSPs and IT teams who are trusted when they raise concerns
Tech matters. Budgets matter. Controls matter.
But the organisations with the fewest breach stories are rarely the ones with the flashiest dashboards. They’re the ones where security fits the culture, not fights it.
Try our Cyber Culture Pulse Check to see how your organisation scores.
Cultural reframing: from blame to curiosity
Use this as a prompt sheet in incident reviews, governance meetings or training sessions.
| Default reaction | What this misses | Culture-first reframe |
|---|---|---|
| “Who clicked the phishing link?” | Assumes one careless person is the problem and ignores workload, pressure, design, training and fear of speaking up. | “What were the circumstances behind the click?” Were they rushed, short-staffed, covering two roles, on a mobile, or worried about delaying a senior colleague? |
| “We told people about this in training.” | Confuses “message sent” with “behaviour changed” and ignores repetition, context, and how people actually work. | “How easy is it to do the right thing in real life?” Do processes, screens and deadlines nudge people towards the safe option or the fast workaround? |
| “Staff keep using unapproved tools.” | Treats Shadow IT as a discipline issue instead of a signal that official tools are slow, clunky or missing features. | “What problem are these tools solving better than ours?” Can we fix the friction or safely bring the useful behaviour into the fold? |
| “Finance should have spotted that fake bank change.” | Puts all responsibility on one person and ignores process design, segregation of duties and pressure from “urgent” emails. | “How do we make payment fraud hard to pull off?” Two-person checks, call-backs on known numbers, and support for staff who slow payments down when something feels off. |
| “Why didn’t they report this sooner?” | Ignores fear of blame, past reactions, and whether the reporting route is simple, visible and psychologically safe. | “What signals do we send when people make mistakes?” Do we thank them for speaking up, or make them regret it in front of peers? |
| “We’ve bought good security tools, job done.” | Over-weights tech and under-weights leadership, workload, communication and follow-through on process changes. | “Where might culture quietly be undoing our controls?” Are there unwritten rules like “never say no to senior staff” or “just get it paid” that trump policies? |
| “We need stricter policies.” | Assumes more rules equal more safety and ignores how often policies are unread, unrealistic or disconnected from daily work. | “What one habit change would make the biggest difference?” Short, practical expectations, backed by leaders modelling the behaviour and removing obstacles. |
