It's All About the Lightbulb Moments

Metrics in cyber security awareness can be a bit of an art form, and will need to vary between organisations. But I realised yesterday while half way through a training session that I have access to one of the best metrics there is - lightbulb moments!

Now I like to do things a bit different:

• I keep it real simple, so no jargon, no acronyms, no IT guff.
• I talk in plain English. I mean really, I'm not out to impress anyone, I'm there to help people learn! And frankly I'm not so good at big words anyway. I guess it shows through in my writing, and I'm cool with that.
• I don't have much content. Sure there's a lot to get through, but really most of my stuff is a few dot points, a picture, a video, some examples, some whacky animations like a poo flying towards a fan and then spraying all over the screen. And then I talk about my experiences and my stories, and how I would do things. So it's real and relatable.
• I try to keep the session light hearted and fun. So I'll crack jokes (typically sarcastic which I'm told is the lowest form of wit). I want people to have fun with this, share their crazy stories, throw some abuse at each other, but it's all in gest and keeps people engaged. And it works.
• And I always bring donuts. The power of donuts is incredible, these crappy little 50c balls of death by gluten are amazing for perking people up, and keeping them thinking life is great and cyber security awareness is awesome!

And all that translates into this - people's eyes lighting up as they realise how they can drastically change their behaviour for the benefit of their personal and business life.

Sometimes it's an awakening, sometimes it's a look of pure shock, sometimes it's a frantic scribbling of an action item, or the boss saying everyone's getting dedicated work laptops with hardware encryption and if you kid touches there will be a public flogging. But it's people relating to the content, and making a change, and that's awesome.

So that's why I do what I do, and ultimately that's how in my mind I like to measure my success.