All Things Human Risk Management is the essential podcast for cybersecurity professionals seeking to strengthen their organization's human defenses. Get actionable insights on emerging threats, behavioral science, and data-driven training techniques to transform your employees from your biggest risk into your strongest defense.
Your Security Awareness Program Has Plateaued - What Happens Next?
Episode #12
Many security awareness programs eventually hit a plateau.
Training completion rates look healthy. Phishing numbers aren’t terrible. But progress stalls. Engagement drops. And leadership starts asking a difficult question: are we actually changing behavior?
In this episode, Eliot is joined by Anthony Davis (https://www.linkedin.com/in/infosecant), a security awareness leader with more than a decade of experience building and running programs across major UK retailers. Together they unpack why awareness programs plateau and what practitioners can do to restart momentum.
They explore the warning signs that a program has gone stale, why compliance-driven training often fails to change behavior, and how awareness teams can move beyond annual training toward continuous engagement and real behavioral metrics.
If your awareness program feels stuck - or your metrics haven’t moved in months - this episode offers a practical playbook for getting things moving again.
What you’ll learn in this episode:
How to recognize when your security awareness program has plateaued
Why high training completion rates don’t necessarily mean behavior change
The biggest design flaws that cause awareness programs to stall
Why phishing reporting is a stronger metric than completion rates
How to connect awareness programs with SOC insights and real threat data
Why annual training alone rarely drives lasting behavior change
How storytelling and relevant examples improve engagement
Practical steps to restart momentum in a stagnant awareness program
Timestamps:
(01:03) Introducing Anthony Davis and his background in awareness programs
(02:25) Early signals your program has stopped improving
(04:00) How long to wait before intervening when metrics stall
(05:05) Is a plateau caused by culture, content, or systems?
(09:20) Why engagement and communication frequency matter
(15:10) Behavior change vs policy and compliance training
(30:00) Why mandatory annual training often fails to change behavior
(39:05) Is annual security awareness training fundamentally flawed?
(52:00) What high completion rates but low behavior change really mean
(54:20) Why phishing reporting is one of the best behavior metrics
(57:00) Turning real threats into targeted awareness messaging
(59:00) Connecting awareness programs with SOC insights
(01:01:30) One action every awareness team should take to break a plateau
Host links:
Eliot Baker: https://fi.linkedin.com/in/eliotebaker (https://fi.linkedin.com/in/eliotebaker)
Anthony Davis: https://www.linkedin.com/in/infosecant (https://www.linkedin.com/in/infosecant)
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt (https://hoxhunt.com/) is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
2 Feb 2026
The Ethical Guide to Security Storytelling: Navigating Real Breaches with Care and Respect
Episode #11
Using real breach stories in security training works... but only if you do it ethically.
Real incidents make threats feel concrete, cut through “this would never happen to me” thinking, and drive behavior change. But they also carry real risk: victim-blaming, fearmongering, reputational harm, and loss of trust if handled poorly.
In this episode, Noora is joined by David Badanes (https://www.linkedin.com/in/dbadanes/) (Human Risk Management advisor) to unpack ethical security storytelling: how to use real breaches responsibly, where the line is, and how awareness teams can turn incidents into learning without becoming the villain.
They break down why real stories outperform generic examples, what not to include when telling breach stories, how to operationalize ethical review with limited resources, and how empathy is the key to changing security behavior.
What you’ll learn in this episode:
Why real breach stories are more effective than made-up examples in security training
Where ethical security storytelling goes wrong and how to avoid victim blaming
How to decide whether a real breach is appropriate to use in training
What awareness managers should include (and exclude) when telling real incident stories
How to operationalize ethical review without heavy legal or HR overhead
Why empathy drives better security behavior than fear-based messaging
How to measure whether ethical storytelling is actually changing outcomes
How cultural context affects cybersecurity storytelling in global organizations
Timestamps:
(00:00) Why use real breach stories in security awareness training at all?
(00:15) How do real incidents change employee behavior better than generic warnings?(01:18) Who is David Badanes and why ethical storytelling matters now(02:21) Why do real breach stories work better than fictional examples?(03:40) What are the ethical risks of using real cyber incidents in training?(05:03) What does ethical security storytelling actually look like?(08:27) How should awareness managers choose what parts of a breach to include?(09:24) How do you operationalize ethical review with limited time and resources?(27:10) How does culture change what’s considered ethical security storytelling?(31:36) What good ethical storytelling achieves and what it avoids
Host links:
Noora Ahmed-Moshe: https://www.linkedin.com/in/noora-ahmed-moshe (https://www.linkedin.com/in/noora-ahmed-moshe)
David Badanes: https://www.linkedin.com/in/dbadanes (https://www.linkedin.com/in/dbadanes)
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt (https://hoxhunt.com/) is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
22 Dec 2025
The Attacks Getting Through Your Filters (and How AI Is Scaling Social Engineering)
Host Eliot Baker interviews Petri Kuivala, CISO advisor, and David Badanes, Human Risk Management advisor, about how AI scales social engineering and why humans are crucial for detecting attacks that bypass security filters.
16 Nov 2025
Lets use this: Does Security Awareness Training Even Work? Fixing the Flaws Behind “Training Fails” Headlines
Host Eliot Baker interviews David Badanes, global security awareness leader, about the flaws in security awareness training, dissecting failure modes and offering ways to rebuild programs around behavior change.
30 Oct 2025
State of Phishing 2025: Why SVGs Spiked (and What Still Works)
Host Eliot Baker interviews Maxime Cartier, Head of Human Risk Management, about the State of Phishing in 2025, exploring the surge in SVG attachments, effective phishing techniques, and how training can change behavior.
14 Oct 2025
A CISO’s Playbook for Security Comms (with Jeffrey Brown)
CISO Jeffrey Brown discusses a security communications playbook with host Eliot Baker, focusing on metrics, building a report-button culture, and influencing behavior to reduce risk in this interview.
18 Sept 2025
Virtual Kidnaps, Fake CFOs: Social Engineering Defense in the Age of AI
Host Eliot Baker interviews Dr Jessica Barker MBE, discussing virtual kidnappings and executive impersonations using AI deepfakes, emphasizing the importance of emotional awareness and proactive security measures.
27 Aug 2025
If Completion Rates Don’t Prove Anything, What Does? Why Security Programs Stall Without Real Behavior Change
Host Eliot Baker interviews Maxime Cartier, Head of Human Risk at Hoxhunt, about measuring true behavior change beyond completion rates to reduce human risk.
22 Jul 2025
AI Phishing Attacks Now 24% More Effective Than Humans: Here’s How to Fight Back
Hoxhunt CTO Pyry Åvist discusses with Eliot Baker how AI phishing attacks now outperform humans by 24%, emphasizing the need for adaptive training programs to counter evolving threats in this interview.
29 Jun 2025
What Happens When Users Keep Failing? And Should We Punish Them?
Noora Ahmed-Moshe, VP of Strategy & Operations at Hoxhunt, joins Eliot Baker to discuss whether to punish employees for security mistakes, advocating for positive reinforcement and behavior change through tailored training in this interview.
23 May 2025
Missed RSA 2025? Here’s What Cybersecurity Experts Are Really Talking About
Host Eliot Baker interviews Noora Ahmed-Moshe, VP of Strategy at Hoxhunt, about key insights and concerns of security leaders at RSA 2025, focusing on AI's impact and emerging threats like deepfakes.
26 Mar 2025
How to Measure Behavior Change (Moving From Awareness to Real Risk Reduction)
Episode #1
Are your security awareness metrics actually measuring risk reduction? Or just checking boxes?
Eliot is joined by Maxime Cartier (https://www.linkedin.com/in/maximecartier/) (Head of Human Risk, Hoxhunt) to break down what truly works it when it comes to reducing human cyber risk. Maxime has spent close to 10 years helping organizations elevate security awareness into human-centered risk management and led security culture initiatives for a major global retailer. In this episode, he shares the metrics that actually matter when evaluating your human defense layer and practical frameworks for quantifying risk reduction across your organization.
Here's what you'll learn in this episode:
Why traditional metrics fail to capture real risk reduction
The measurement framework that finally proves ROI to leadership
Behavioral science secrets that transform knowledge into habits
How top-performing organizations quantify their human defense layer
Timestamps:
(00:00) Introduction to the Podcast
(01:08) Understanding Security Awareness
(02:54)The Evolution of Security Awareness
(04:51) Compliance and Security Awareness
(06:49) From Awareness to Behavior Change
(08:40) Measuring Security Behaviors
(11:14) Real-World Examples and Anecdotes
(21:44) The Importance of Reporting Rates
(24:15) Positive Security Culture
(38:30) Adapting to New Threats
(45:13) Conclusion and Final Thoughts
To get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter: https://hoxhunt.com/all-things-human-risk (https://hoxhunt.com/all-things-human-risk)
Resources:
Guide to behavior-based training: https://hoxhunt.com/blog/behavior-based-cyber-security-training (https://hoxhunt.com/blog/behavior-based-cyber-security-training)
4 essential metrics to start tracking: https://hoxhunt.com/blog/4-essential-phishing-metrics (https://hoxhunt.com/blog/4-essential-phishing-metrics)
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/ (https://www.linkedin.com/in/eliotebaker/)
Maxime Cartier: https://www.linkedin.com/in/maximecartier/ (https://www.linkedin.com/in/maximecartier/)
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt (https://hoxhunt.com/) is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Who has been a guest on All Things Human Risk Management
Names identified in recent episode analyses. Showing up to five guests.
Petri Kuivala
David Badanes
Maxime Cartier
Jeffrey Brown
Dr Jessica Barker MBE
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
YouTube views
249,523
Score snapshot 15 Sept 2025
Podcast Authority Score: 24 / 100
A composite of feed quality, social presence, YouTube performance and engagement. Read the methodology.
Quality
16
Social presence
0
YouTube
82
Engagement
0
Contact All Things Human Risk Management
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of All Things Human Risk Management?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
