When Nobody's Watching

About When Nobody's Watching

Honest, tension-led conversations about what people really do once the security training's finished and nobody's looking. From The Cyber Escape Room Co., hosted by Amy Stokes-Waters. New episodes every fortnight.

Publisher

The Cyber Escape Room Co.

Category

technology

Language

en

Explicit

No

First episode

20 Jul 2026

Latest episode

14 Oct 2026

Latest episodes

7 episodes in the feed.

1. 

   14 Oct 2026

   What if attackers don't need urgency | The Attacker, with James Linton & Anthony Enoh

   Every piece of security advice we've given people for twenty years assumes the attacker is in a hurry. Act now. Click here. 24 hours. So what happens when they can afford to wait six months? Anthony Enoh runs incident response and builds AI agents for a living. James Linton spent a stretch as an email prankster, tricking the head of Homeland Security and a good chunk of the White House. Anthony's prediction is the one to sit with. Not a link to click, a relationship: an agent that works out what interests you, sends something benign, then another, then an actual event you actually enjoy. Benign, benign, benign. Then, months later, the ask. James: "You mean salespeople." Anthony: "Yes." In this episode: - "I didn't have to build trust. I just exploited existing trust." How a borrowed display name does the work, and why a live persona gives you many bites of the cherry - Every incident Anthony has worked started with the human element, and he's clear that doesn't mean the human failed: "I would argue the technical controls have failed" - The best rebuttal to "the weakest link" in this series: saying humans are inherently insecure is like saying Windows machines are. There are just more of them - Why the advice contradicts the job. You are paid, in part, to open the emails that arrive in your inbox - "Ha ha, you got business email compromised." Amy's Christmas party story, and the phishing simulation that taught nobody anything - The toddler in the biscuit jar: why the teachable moment arrives far too late to teach anything - You cannot report an email you haven't opened - Why cloning your CEO's voice is usually a waste of everyone's time, and why "I don't recognise their voice" is as good a tell as any - Never be more generous in a phishing simulation than you are in real life - Fix It in 60: we hand them a genuinely terrible phishing email, and they rebuild it Read the write-up and watch the clips: https://www.cyberescaperoom.co/resources/when-nobodys-watching-podcast/episode-7-the-attacker/ When Nobody's Watching is the podcast about what people actually do once the security training's finished, hosted by Amy Stokes-Waters. New episodes fortnightly. Made by The Cyber Escape Room Co., a behaviour change company: cyberescaperoom.co

2. 

   30 Sept 2026

   The standard you walk past is the one you accept | The Standard, with Dane Clackworthy

   "The standard you walk past is the standard you accept." It's a Royal Marines saying, and the part people skip is who it's aimed at. "That doesn't just apply to a young Marine or a young employee. That literally applies to the highest forms of leadership." If you see something that isn't right and you walk past it, everyone who watched you do it now knows the real standard. Dane Clackworthy grew up in Cape Town, came to London at 18, and found out about the Royal Marines from a book in a library near the pub he was working in. Pre-internet. He joined, stayed more than twenty years, and now runs UK and Ireland for an OT cyber security company. He's also, full disclosure, Amy's partner. WHAT WE GET INTO - Why culture is built in the first three weeks, and what a Marines induction actually covers - Respectfully challenging: how the Marines design disagreement into the plan, before anything goes wrong - Why everyone trains one rank up, and sometimes two - The incident lead who was certain he was holding it together, while everyone around him could see he wasn't - Why annual training is the lowest form of preparation, and what replaces it - Snow holes, icebreaking drills, and why it doesn't have to be real, it just has to feel real - Commando mindset: understand, adapt and respond, overcome - Fix It in 60: a training reminder email marked "third and final" WATCH & LISTEN Full episode + all episodes: whennobodyswatching.co.uk Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204 ABOUT The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know. Website: cyberescaperoom.co Podcast: whennobodyswatching.co.uk LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/ #WhenNobodysWatching #CyberSecurity #SecurityCulture #IncidentResponse

3. 

   16 Sept 2026

   "People Need to Know You Exist" | The Persuader, with Owen Sutton

   "People need to know you exist. If they're gonna scroll past the email, everything else is a waste of effort." Marketing has spent a hundred years working out how to change what people do. Security has spent twenty years telling people what to do. Owen Sutton has never worked in cyber security, and that's exactly why we handed him the awareness campaign as a brief. Owen spent 21 years at BT, finishing as head of brand management and design, where he ran the in-house design team. Before that, portfolio marketing in BT Global Services, plus stints in bid management and global operations. He now runs Quietwork, building AI automation and digital systems for small businesses. WHAT WE GET INTO Why security comms bounces: techy people talking to techy people, and far too many bullet points The subject line is the whole job. Get scrolled past and everything else you did was wasted The old rule was get it in front of people 7 times. Owen thinks it's now 70 Run one message a quarter, not all of them at once. The bins analogy that explains why Gamification that costs nothing: tell them the finance team are beating them by 5% Hyper-personalisation past the first name, and video built on the fly Nobody outside your team knows it's Cyber Security Awareness Month Ban WeTransfer and people will find a way round it. Go and talk to marketing instead Why fear works for about a month: the horror film a week his household sat through Fix It in 60: the worst cyber awareness poster we could manufacture WATCH & LISTEN Full episode + all episodes: whennobodyswatching.co.uk Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204 ABOUT The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know. Website: cyberescaperoom.co Podcast: whennobodyswatching.co.uk LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/ #WhenNobodysWatching #CyberSecurity #SecurityCulture #Marketing

4. 

   2 Sept 2026

   "Nobody knows how they act under pressure" | The Observer, with Katie Maycock

   Your bank has texted you to say they will never call you. On the day they call you, you will not be thinking about that text, because your kid will be screaming and you'll be late for something. That's where Katie Maycock starts, and she's never worked in cyber security a day in her life. That's exactly why she's here. Katie runs GYST (Get Your Sh*t Together), working with companies on what pressure actually does to an individual, what it looks like in a team, and the ripple effect across an organisation. A decade in corporate sales first, then a business built on the science of pressure rather than the yoga mat. She also runs an escape room we built for her, and uses it to watch leaders make decisions with the clock running. WHAT WE GET INTO - Why attackers moved to the phone, why urgency works on distracted people, and the call that cost 30 grand - The five things people do under pressure: drivers, analysts, harmonisers, shifters, sprinters - Your set point, and why you fall to your instinct instead of rising to your training - The first sign of stress is a change of habit, and your employer usually rewards it - The ripple effect: the real risk isn't the person who burns out, it's the team absorbing their work - What fear based leadership does to decisions, and why it outlives the leader who started it - Fix It in 60: an inbox with a training email buried in it WATCH & LISTEN Full episode + all episodes: whennobodyswatching.co.uk Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204 ABOUT The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know. Website: cyberescaperoom.co Podcast: whennobodyswatching.co.uk LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/ #WhenNobodysWatching #CyberSecurity #Vishing #Burnout

5. 

   19 Aug 2026

   "You have to be nice to people. Kind of." | The Scientist, with Bec McKeown

   "You have gotta be nice to each other, kind of." That's a psychologist being asked whether psychological safety just means everyone being pleasant. The "kind of" is the whole episode. "It's not psychological safety if everybody's so nice there's never any challenge." Twenty years of research into why capable, well-trained people still make the wrong call under pressure. Bec McKeown has done the science, in defence, aviation and rail, and the science does not say send another module. Her own research at Cranfield put a number on it. Procedural and decision-making skills need refreshing about every 8 weeks to stay at gold standard. After that they fade. So what exactly is the annual module protecting? Bec McKeown is a Chartered Psychologist and the founder of Mind Science. She's also a magistrate, which is why she doesn't speed. WHAT WE GET INTO - Psychological safety is not everyone being nice to each other, and the difference matters - Skill fade: 8 weeks, and the thing you trained for is going - "You'll comply, but you're not engaged." The half of that sentence nobody measures - Everybody knows the speed limit. Everybody speeds. Knowing and doing sit in different parts of the brain - The Friday afternoon Bec nearly got phished, the day after her first VAT return - Reason's Swiss cheese model, and why the person who clicked is only the first slice - Aviation calls it a just culture. Cyber security fires the person who clicked - Blame gets you silence, and silence is a much worse place to be - Security awareness is a change management programme, and nobody runs it like one - The real influencers in your organisation are not the boxes on the org chart - "Just pick the most legal sounding answer." How people pass the test without learning anything - They're not the weakest link. There are simply more of them - Fix It in 60: our security awareness quiz, and what's missing from it CHAPTERS 0:00 Intro [add timecodes from the final cut] WATCH & LISTEN Full episode + all episodes: whennobodyswatching.co.uk Spotify: https://open.spotify.com/show/033SHqMBe6sNPmRu88nQTb Apple: https://podcasts.apple.com/gb/podcast/when-nobodys-watching/id6792770204 ABOUT The Cyber Escape Room Co. is a behaviour change company. We use immersive experiences to change what people actually do, not just what they know. Website: cyberescaperoom.co Podcast: whennobodyswatching.co.uk LinkedIn: https://www.linkedin.com/company/the-cyber-escape-room-co/ #WhenNobodysWatching #CyberSecurity #SecurityCulture #HumanFactors

6. 

   5 Aug 2026

   "Blame is What Causes Incidents" | The CISO, with Kieren Lovell

   Kieren Lovell has spent four careers watching people under real pressure: two years on nuclear submarines, mine disposal, setting up the cyber warfare division at the Norwegian Navy's frigate training centre, hunting pirates off Somalia, running computer emergency response at the University of Cambridge, and now the CISO chair at Pragmatic Solutions.So when he says the industry measures the wrong things, it lands differently.He refuses to run phishing simulations, even though every board asks for them. He thinks most tabletop exercises are discussion workshops with a slide deck. And when Amy asks who's accountable if the next breach turns out to be behavioural, his answer is two words: always me.In this episode: • Why a click rate is set by whoever writes the email, so what you're really measuring is the security team's grammar• "We do the plastic metrics instead" — the command, control and leadership measures nobody collects• The military rehearses little and often: fire, flood, famine, every day. Cyber trains people for before an incident and never for during one• Labelling theory, explained via a 14-year-old boy, and why a wall of shame kills your reporting culture• The incident he had no playbook for• Why a ridiculous scenario can beat a realistic one• What he actually puts in front of his board, and what he refuses to• Fix It in 60: we hand him a real board update slide and give him 60 secondsRead the write-up and watch the clips: whennobodyswatching.co.ukWhen Nobody's Watching is the podcast about what people actually do once the security training's finished, hosted by Amy Stokes-Waters. New episodes fortnightly.Made by The Cyber Escape Room Co., a behaviour change company: cyberescaperoom.co

7. 

   20 Jul 2026

   "I've Clicked on My Own Simulation" | The Insider, with Holly-Jane Grayling

   "I've clicked on my own simulation before." Holly-Jane Grayling builds security awareness and culture for a living. She still got caught by her own phishing test. Rushed, mid-task, chased to finish her mandatory training. Because no one is immune, and that's exactly the point. In Episode 1: The Insider, Amy Stokes-Waters sits down with someone who's spent over a decade on why people do what they do, for an honest, no-gotchas conversation about the gap between what security training says and what people actually do once the module's closed and nobody's looking. In this episode: Why "people are the weakest link" is nonsense, and what they really are Designing for perfect conditions vs what happens in the real world Why 99.9% of the time it isn't a training need Compliance as a starting line, not a finish line Measuring behaviour change, not completion rates The one word that makes everyone's brain switch off Plus the first ever Fix It in 60: Holly gets 60 seconds to fix a real piece of security content, live, on instinct. More info: whennobodyswatching.co.uk (https://whennobodyswatching.co.uk) Connect with Holly: Holly's LinkedIn (https://www.linkedin.com/in/hjgrayling/) When Nobody's Watching is a video podcast from The Cyber Escape Room Co. (https://cyberescaperoom.co), hosted by Amy Stokes-Waters. New episodes every fortnight.

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

2 ratings

Contact When Nobody's Watching

Guest appearances

Books guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.