Psychology of Change and Cybersecurity
Digital security and cybersecurity: awareness that changes behaviour
Controls get bought, then bypassed. The fix is behavioural: fewer risky clicks, faster reporting, and habits that hold after the session.
Digital security and cybersecurity overlap. We work on the human side of both: using the tools, spotting manipulation and reporting concerns, online, by phone or in person.
You may be seeing
- Phishing simulation results plateau, then drift back
- Incidents reported late, or not at all
- Security treated as the security team’s job
- Everyone passes the annual module and nothing changes
Psychology of Change and Cybersecurity, at a glance
CPD accredited- Format
- 8 to 24 hours. In person or online. Delivered by us, or by your own trained facilitators. Part of Adapt Better.
- You receive
- A toolkit for spotting and checking scams
- A clear, blame-free way to report concerns
- A manager pack to keep the safer behaviour going
- Evidence
- 85% improved their digital knowledge, and nobody got worse (case study, run as this programme)
Free, no obligation. Outcomes and deliverables are agreed before we start.
What happens
In the room
Live social engineering exercises where participants run the attack, then feel it run on them.
- Attacker-side exercises where participants build the pretext
- Live social engineering demonstrations
- Near-miss debriefs run without blame
- Reporting-path redesign with the security team in the room
What people will be able to do
Afterwards, people can:
- Spot the red flags, and how they trick the mind
- Slow down before clicking or replying
- Report a mistake early, without fear of blame
- Help a colleague handle a suspicious message
Outcomes
What it adds up to
Controls that get used
Security controls and routines people actually take up and keep using, not just pass once a year.
Verify, then report
Check before acting, and report it early.
More successful projects
Work that reaches real use and gets finished, not just planned.
Rolling out AI at the same time? Adoption runs on the same behaviour. Psychology of Change and AI.
This is also a component of ‘MindHug One’, 40 hours of training grounded in behavioural science, across wellbeing, AI and cybersecurity, and entrepreneurship.
Evidence
Does it work?
Measured: recognition, psychological safety, confidence to report. Reported at follow-up: phishing caught, not clicked. The return: stronger digital security, fewer incidents, less lost time.
- Improved their digital knowledge, and nobody got worse, DSIT Digital Skills Initiative
- 85%DSIT Digital Skills Initiative
- Of psychological safety measures increased, DSIT Digital Skills Initiative
- 96%DSIT Digital Skills Initiative
- Grew in confidence applying complex digital skills, DSIT Digital Skills Initiative
- 75%DSIT Digital Skills Initiative
- Governments
UK Government, DSIT
- Result
- 85% improved their digital knowledge, and nobody got worse
- Outcomes we delivered
- A 28 hour programme applying digital skills to real work: 75% grew in confidence with complex digital skills, and 20 coaches were trained to lead adoption work.
“All the time I had to deal with cyber training I was bored of it or saw it as a pain, and now with the training I am now advocating for it, asking more questions.”
Delivery
How it is delivered.
We deliver it
Our facilitators and psychologists run it with your cohort, in person or online.
We train your people
Your own coaches are trained to deliver it, so it continues after we leave.
Tailored either way. Built around what you are actually seeing, not picked off a list.
What is included
- Facilitated sessions, in person or online
- Manager briefing pack
- Participant toolkit
- CPD accreditation
- Measurement against a pre-programme baseline
How progress is assessed
- Security behaviour and confidence, measured before and after
- Whether risky clicks drop and near misses get reported, the behaviours that matter
Knowing matters. Doing changes things.
No obligation.
A few lines is enough.
Why it works: what is underneath the behaviour
Underneath the behaviour
- Attackers target shortcuts, not knowledge. Urgency, authority and familiarity are the mind working normally
- Reporting requires psychological safety. Where blame is expected, silence is rational
- Compliance training teaches recognition of a test, not of an attack
How this programme is built, step by step
Safety
Blame comes off the table first. People cannot examine their own near misses while defending themselves.
01Understanding
How attacks work on attention, and why being clever is no protection.
02Reframing
From "I should have known better" to "this was built to work on anyone, here is the tell".
03Experience
Live social engineering exercises where participants run the attack, then feel it run on them.
04
Safety opens exploration. Exploration creates experience. Experience updates what people expect. Updated expectations change behaviour, and feed back into safety.
Related programmes