Rose State College

Director of Cybersecurity / Professor of Cybersecurity

Cybersecurity Professor / Cybersecurity Program Coordinator

Southeastern Oklahoma State University

Adjunct Professor - John Massey School of Business - MBA Program

The Tiaki Group, LLC

Principal | Cybersecurity Strategist | Transformation | Risk Management | Budget Management

Shyft Partners, LLC

CONFIDENTIAL CLIENT: CARES ACT INITIATIVES (Coronavirus Aid, Relief, and Economic Security)

➤  Provided leadership, oversight, and project management support for 60+ CARES Act Projects, impacting multiple organizations. Oversaw critical technology initiatives prioritizing healthcare and public safety. Worked closely with cross-organizational leadership to prioritize projects with total budget of $600M. Reported to Client COO.
➤  Oversaw digital transformation and modernization to provide efficient, service-oriented, secure systems and solutions for allocation of program funding.
➤  Managed expansion of IT technology systems to enable and ensure secure state systems and data;  established disaster recovery and business continuity (DR/BC) capabilities.
➤  Facilitated review of technical implementation plans with multiple organizations and helped non-technical staff understand them.

CONFIDENTIAL CLIENT: ENTERPRISE TRANSFORMATION INITIATIVE
➤  Provided management consulting leadership and oversight of strategic planning to drive transformation, unifying Client Organization with aligned enterprise vision and priorities. Collaborated with executive leadership. Indirectly managed 40+ resources from C-suite to staff ICs. Reported to Client COO.
➤  Established and led program governance and change management frameworks, processes, and procedures for project intake, increasing efficiencies, reducing redundancies, and optimizing costs.
Increased financial transparency and optimized financial performance by defining and measuring metrics to track and manage spend.
➤  Introduced participatory budgeting process to provide inclusive and transparent prioritization of funding; managed 1st participatory budgeting event from project submission through execution and reporting.
➤  Drove rescue of ERP implementation project: incorporated overlooked workflow designs and existing systems integrations to ensure successful implementation with efficient and effective results.

Principal Consultant/Co-Founder | Technology & Cybersecurity Advisor | High Risk Initiatives

Nearshore Cyber

Provided CISO advisory and consulting services with cybersecurity strategy and solutions to SMB clients.

KEY ACHIEVEMENTS
➤ Drove cybersecurity program transformation for mid-sized client, improving security and stability. 
+ Performed cybersecurity assessment based on CIS Controls Version 8.2; interviewed CEO, CFO, CIO, IT team, and vendors; reviewed detailed vulnerability scan reports.   
+ Developed near-term recommendations to improve client’s security posture quickly.
+ Crafted 12-month Cybersecurity Transformation Roadmap.
➤ Directed establishment of 2024 cybersecurity program for SMB client. 
+ Facilitated selection of cybersecurity vendor partner to perform penetration tests and secure code reviews, including scoping of 1st pen tests for January 2024 release and code reviews.
+ Drove implementation of governance, risk, and compliance (GRC) management platform.
+ Created key cybersecurity policies for client management to review.
➤ Coached client leadership and IT staff regarding how to identify business-critical systems, IT and business risks, apply OWASP, plan and manage budgets, reduce cost, and optimize IT tool cost/usage.
➤ Fostered inclusion across organizations in security program decision-making, and coached and mentored staff to ensure understanding of concepts and implications.

Fractional CISO | Cybersecurity Strategist | Cybersecurity Transformation | Risk Management

QAT Global | Custom Software Development

Hired to bring experience resolving and managing complex, high-profile crises with critical deadlines and providing expertise in technology and cybersecurity. Directed technology portion of high-risk vendor contract re-acquisition initiative while ensuring continuity of DHHS case management services and regulatory compliance. Worked closely with IT, Legal, and Data. Supported agency of 4K+ workers (in- and out-of-state). Reported directly to PMO Leader and indirectly reported to DHHS CIO.

KEY ACHIEVEMENTS
➤  Managed urgent, short-timeline transition of ownership of case management while maintaining critical continuity of end-to-end services, including hotlines, transportation, documentation, software, data, laptops, equipment, security, and staff and employee access.
➤  Provided transparent, open communications DHHS leadership, including daily CIO updates.
+ Led team of 40 (vendor, state, and agency staff) to execute compliant, seamless transition.
+ Oversaw purchase and distribution of new and re-allocated (wiped/reissued) laptops and peripherals to new state employees (per contract re-acquisition); ensured asset management compliance.
+ Provided calm leadership and facilitated adaptable team performance by establishing stable structure, processes, and transparent communications.
➤  Led initiative to implement technical remediation for security-related audit findings.
+ Directed statewide upgrade plans to replace 3,600 laptops statewide; led project team of 75.  
+ Drove migration of systems to virtual environment to improve access control and increase security for sensitive state and federal agency data; managed access requirements for virtual environment.
➤ Provided cybersecurity advisory during contract/SOW reviews and key initiatives planning sessions.
➤ Delivered on-the-job training and coaching on Agile methods to portfolio-level leaders while defining and modeling appropriate project and portfolio practices; provided ongoing coaching and support to PMs.

Strategic and Technical Consultant | Audit Remediation | High-Risk/High-Profile Programs

Oklahoma State Department of Health

Architected and led inaugural PMO, establishing structure, accountability, and governance for projects/programs to support 2,000-person organization, distributed across 60+ sites. Built, coached, and managed team of 7. Worked cross-organizationally with business unit senior/executive leadership to prioritize and execute high-visibility, high-risk programs and transformation initiatives. Reported to Deputy COO and Chief Transformation Officer.

KEY ACHIEVEMENTS
➤ Drove improvements in quality and effectiveness of initiatives for agency; enabled open, transparent communications of active projects/programs.
➤ Defined and built PMO framework and management processes, including prioritization, governance, staffing, and financial tracking; expanded to include enterprise transformation initiatives management (TMO).
➤ Elevated transparency by creating dashboard w/reporting to track status and funding.
➤ Ensured strategic alignment of projects/initiatives by establishing intake and approval processes.
➤ Owned TMO workstreams: provided execution oversight and support; drove open, transparent communications; presented updates to Steering Committees with Cabinet-level, C-suite, and senior business leaders; facilitated communications between business and consultants to ensure alignment. Critical (High-Risk, High-Visibility, High-Impact) Transformation Initiatives Included:
+ Established and formalized Enterprise Change Management (ECM) strategy and processes.
+ Built structured process to update and align agency mission, vision, values, and strategy.
+ Employee Experience Improvement Initiative (focused on engagement and retention)
+ Redesigned Financial Processes to Improve Management and Compliance
➤ Quickly established trusted communications with stakeholders, staff, and external consultants.
➤ Fostered inclusion across organization in decision-making, facilitated transparency of information, and coached and mentored staff to ensure understanding of concepts and implications.

Director, PMO | Transformation

Inspire Brands

INSPIRE BRANDS (Acquired Sonic in 2018), Oklahoma City, OK and Atlanta, GA	2019 – 2020
American fast-food restaurant franchise company owned by Roark Capital Group, with 31,700 locations & $30B sales.
Director, Enterprise Program Management Office  | 	
Directed post-acquisition integration of Sonic PMO into Inspire Strategic Enterprise PMO, including staff assignments, reporting systems, and program management best practices. Provided Agile thought leadership and advisory to executives, senior leaders, and teams to build foundation for successful transformation, applying expertise in multiple methodologies. Matrix managed 6 teams of up to 15 each. Reported directly to SVP of Finance. 

KEY ACHIEVEMENTS
➤ Spearheaded technology and systems integration starting post-acquisition/day 1, maintaining confidentiality.
➤ Selected to triage high-risk, critical ERP system and secured $4M for system stabilization and recovery initiative; managed initiative, partnering with FPA, Accounting, Treasury, Reporting, Internal Audit, and IT teams. Collaborated closely with C-suite stakeholders, senior executives, and vendors.
➤ Managed and coached key players and staff showing signs of high stress and workplace anxiety; provided stability through structure, processes, and calm leadership and fostered team performance improvement.
➤  Drove implementation of security module to add role-based access; worked with vendors and internal teams. 
➤ Led executive-level steering committee meetings; created and delivered presentations.

Director, Enterprise PMO | Post M&A Integration | Calm Leadership Under Pressure | Executive Advisor

SONIC Drive-In

Directed IT PMO and managed enterprise IT and security programs supporting HQ, Corporate, and Restaurant BU and impacting users at 3600 Sonic locations including 400 franchisees. Directly managed team of 6 (PMs, BAs). Matrix managed project/program distributed teams of up to 30FTEs plus contractors, including Security Operations, GRC, Security Architecture, Security Engineering, IAM, Networking, Helpdesk, and Datacenter Teams. Collaborated with legal, finance, accounting, and internal audit teams. Reported to VP Cybersecurity and Enterprise Systems and VP (Corporate) PMO. Managed budgets of up to $20M+, including G&A, Capital, and Restaurant Cybersecurity expenses.

KEY ACHIEVEMENTS
➤ Collaborated with cybersecurity leadership team to develop annual strategy and plans based on NIST CSF.
➤ Directed incident response lifecycle efforts for incident response team of 24 during high-impact incident.
➤ Attained PCI Compliance, Service Provider status by directing project team under high-pressure deadline.
➤ Directed vendor management: selection, contract negotiation and review (including SOC2), onboarding, and performance management (with QBRs).
➤ Led Active Directory upgrades, achieving zero issues of backward compatibility by identifying and prioritizing dependencies across separate (siloed) business units while driving open, transparent communications.
➤ Led Change Advisory Board (CAB) and managed Change and Release Management Team to deploy software to 3600 stores on 2 POS systems.
➤ Coached and managed professional development for IT PMO staff, improving skills development and employee engagement.
➤ Established and documented standard cybersecurity operating procedures to ensure security and compliance.

Director, Cybersecurity & Enterprise Systems Programs 

Hired as 1st IT PMO/Program Manager as part of newly formed Enterprise Systems and Cybersecurity Team. Oversaw and managed enterprise IT and security programs supporting HQ, Corporate, and Restaurant BU and impacting users at 3600 Sonic locations including 400 franchisees. Built and managed team of 6 (PMs, BAs). Matrix-managed distributed teams of up to 30+, including GRC, Security Architecture, Security Engineering, IAM, WAN, Helpdesk, and Datacenter Teams. Reported to VP Cybersecurity and Enterprise Systems and VP EPMO. Managed budgets of up to $10M. 

KEY ACHIEVEMENTS: CYBERSECURITY & ENTERPRISE SYSTEMS 
➤ Closed highest priority company risk on risk register by initiating and implementing technology deferred maintenance recovery program; designed and operationalized monthly maintenance program to ensure ongoing PCI and corporate compliance.
➤ Built and facilitated framework and standardized processes for project intake approval, resource allocation, and budgeting for Cybersecurity and Enterprise Systems Department. 
➤ Enabled near-real-time financial data-driven decision-making by introducing project/program-level budget and expense tracking and management.
➤ Directed remediation of internal and third-party security assessments findings.
➤ Designed and administered franchisee security assessment; trained franchisees on cybersecurity.
➤ Managed professional development for IT PMO staff, improving skills and employee engagement.
➤ Directed vendor selection, contract negotiation/review (including SOC2), onboarding, and performance management.
➤ Fostered collaborative, cross-organizational inclusion in decision-making, facilitated transparency of information, and mentored staff to ensure understanding of risks, risk identification, and risk management.
➤ Introduced Lean Portfolio Management including Participatory Budgeting to senior leadership and directed implementation creating alignment, prioritization, and cadence for capital project approvals through delivery.

Program Manager Cybersecurity & Enterprise Systems

Managed POS System Program (including integrations with supply chain and back office) from POC through operations testing, pilot execution, and deployment to select company-owned stores. Collaborated with corporate, IT, and store operations teams. Led team of 6. Reported to VP of IT. 

KEY ACHIEVEMENTS
➤ Established project communications with corporate, IT, and store operations to facilitate collaboration and enable inclusion in decision making, ultimately ensuring successful POS deployment. 
➤ Presented audience-targeted financial and operations data to accounting, supply chain, and restaurant operations throughout POS System Program delivery and execution.

Program/Project Manager, Back Office Systems  (TEK SYSTEMS Consultant) 

University of Oklahoma College of Liberal Studies

Taught Quality Initiatives course (remote) introducing students to analytics and continuous process improvement. Worked with diverse adult students (30 per semester), all remote. Posted weekly course updates and announcements. Collaborated with faculty, academic staff, and campus leadership.

KEY ACHIEVEMENTS
➤ Completed quality check/review of assigned course and updated within guidelines.
➤ Conducted course as designed through the learning management system.
➤ Engaged fully with students, driving active course participation, responding to student questions, and supporting their success; interacted with students via the discussion board and comments.
➤ Provided personalized and substantive feedback on all student submissions and assignments.
➤ Maintained and submitted accurate and timely student grades.
➤ Developed introductory Project Management course.

Adjunct Professor | SA Qualified (2023) | Information Systems | Management | Cybersecurity

Passionate, adaptive leader driving strategic cybersecurity program transformation, aligning cybersecurity efforts with overall business goals. Masterful at managing complex, high-profile risks with critical deadlines by leveraging technology, cybersecurity, and transformation experience. Build scalable, adaptable security teams, optimizing performance while ensuring teams are prepared, resilient, and well-supported. Reduce waste and minimize costs by skillfully identifying complex patterns in cybersecurity challenges and creating efficient processes and tools. Foster company culture of risk prevention and protection by forming relationships and collaborating cross-organizationally. Partner with CISO, Board, and investors.

---CAREER HIGHLIGHTS---
➤ Managed and resolved complex, high-profile, high-impact organizational risks with critical deadlines applying calm leadership and applying expertise in technology and cybersecurity.
➤ Directed incident response lifecycle efforts (identification through recovery) for incident response team of 24 during security breach.
➤ Established and managed cybersecurity programs in SMBs and large, publicly traded company.
➤ Spearheaded multiple successful high-visibility large-scale enterprise transformation initiatives and programs, providing stability with structure, frameworks, processes, governance with coaching and mentoring support.
➤ Fostered inclusion across organizations in security program decision-making, facilitated transparency of information, and coached and mentored staff to ensure understanding of concepts and implications.
➤ Managed and coached key players and staff showing signs of high stress and workplace anxiety; provided stability through structure, processes, and calm leadership and fostered team performance improvement.
➤ Repeatedly entrusted with confidential, highly sensitive information.
➤ DBA Dissertation: All Quiet on the Digital Front: The Unseen Psychological Impacts on Cybersecurity First Responders

---SIGNATURE STRENGTHS and SKILLS---
Cybersecurity Strategy 
Cybersecurity Program Development
Manage High-Profile, High-Impact Risks 
Drive Transformation 
Scalable Frameworks & Systems
Prioritization & Budgeting
Stakeholder Management
Calm Leadership Under Pressure
People-first Leader
Build & Develop Resilient Teams
Environmental Awareness 
Connect-the-Dots Others Don’t

Dr. Tammie Hollis

Phishbusters Ltd

Phishbusters is what we call our innovative program that I have developed and perfected over the last 15 years of experience executing phishing awareness training. 
Our unique value proposition goes beyond compliance requirements and provides concrete metrics that provide visibility into actual training effectiveness from true baselines.

Vendors provide activity metrics by simulation. But this vertical measurement approach tells us very little about effectiveness — which requires horizontal measurement from true baselines.

My unique one of a kind service provides the horizontal insight programs need to measure impact and drive continuous improvements

Phishing Training Metrics Expert

After my experience in the IT security industry of over 5 years, I started to do audits and consulting services with a focus on phishing awareness security.

Founder

Phishing training metrics are broken.

Most SAT and HRM vendor platforms measure activity — not impact.
Click rates, completions, risk scores… look like progress but don’t measure reduced risk.

Vendors have monetized what psychologists call “activity bias”— the illusion that busyness equals improvement. Their metrics are built to drive engagement with their platform but not behavioural change — benefiting them, not you.

I run a boutique, independent assessment service for security leaders who want objective, defensible proof that their phishing awareness efforts are actually working.

It’s a simple fully managed add-on that helps optimize your awareness program with Metrics That Matter.

Our differentiator: Vendors provide snapshot benchmarks only, we provide BOTH benchmarks AND baselines — which is a game changer.

𝗩𝗲𝗻𝗱𝗼𝗿 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗱 𝗯𝗲𝗻𝗰𝗵𝗺𝗮𝗿𝗸𝘀 𝘁𝗲𝗹𝗹 𝘆𝗼𝘂 𝗵𝗼𝘄 𝘆𝗼𝘂 𝗰𝗼𝗺𝗽𝗮𝗿𝗲 𝘁𝗼 𝗼𝘁𝗵𝗲𝗿𝘀; 𝗯𝗮𝘀𝗲𝗹𝗶𝗻𝗲𝘀 𝘀𝗵𝗼𝘄 𝘄𝗵𝗲𝘁𝗵𝗲𝗿 𝘆𝗼𝘂’𝗿𝗲 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗶𝗺𝗽𝗿𝗼𝘃𝗶𝗻𝗴.

The absence of true baseline metrics remains the industry’s greatest gap.

Without objective measures of incremental impact, awareness programs lack the foundation needed to guide meaningful improvement.

In addition to incremental impact from true baselines I also provide trend analysis to help optimize your training ROI — free of bias or noise.

My trend analysis segments users into three behavioral groups—Never Clickers, Learners, and Movers—so you can stop overtraining the majority and focus where risk remains with the Movers. 

The Movers represent a small minority of users that are responsible for most risk related to phishing — they either stay in the learner category or self identify by ‘moving’ into the training zone. The result: stronger culture, smarter training, and less wasted effort.

Delivered as a low-touch managed service—no integrations or internal burden—it gives you clarity, confidence, and a clear return on your awareness investment.

Tired of meaningless activity metrics? If you want metrics that matter and insights that actually help you optimize your programs and lower your risk, let’s connect.

We’re fully set up for private and public-sector delivery, with a SKU through Staples Professional, active government supply arrangements, and the necessary security clearances for our service.

Cary Johnson

Many security awareness programs actually work pretty well.

Any program that genuinely cares about security beyond compliance is probably working.

We just don’t know how well — and 𝐭𝐡𝐚𝐭’𝐬 the issue.

People are learning. Tools are getting better. Content is more engaging than ever.

SAT/HRM platforms have the potential to unlock far more value.

𝐀𝐧𝐝 𝐡𝐞𝐫𝐞’𝐬 𝐭𝐡𝐞 𝐩𝐚𝐫𝐭 𝐰𝐞’𝐫𝐞 𝐬𝐭𝐢𝐥𝐥 𝐦𝐢𝐬𝐬𝐢𝐧𝐠…

Almost all of the “proof” that programs are working comes from the very platforms that sell the training.

Click rates. Completion rates. Risk scores. Engagement dashboards.

They show activity, but they don’t fully unlock the potential of the platform.

Some of the metrics are helpful, some are just noise – but almost none of them objectively prove impact in a way that’s undeniable and independent of the platform’s own story.

That’s the risk when we rely only on vendor performance metrics:
we optimise for activity and pretty dashboards, not for true behaviour change over time.

If we want to genuinely prove impact, we also need:
	•	One Metric That Matters (OMTM) that doesn’t move just because the vendor changes a scoring model.
	•	A framework of North Star metrics that tell us, “𝐼𝑠 𝑜𝑢𝑟 𝑝𝑟𝑜𝑔𝑟𝑎𝑚 𝑎𝑐𝑡𝑢𝑎𝑙𝑙𝑦 𝑟𝑒𝑑𝑢𝑐𝑖𝑛𝑔 𝑟𝑒𝑎𝑙 ℎ𝑢𝑚𝑎𝑛 𝑟𝑖𝑠𝑘 𝑖𝑛𝑐𝑟𝑒𝑚𝑒𝑛𝑡𝑎𝑙𝑙𝑦 𝑜𝑣𝑒𝑟 𝑡𝑖𝑚𝑒?”

Until we have that kind of guidance and objective insight, most awareness programs will stay in “looks good on the dashboard” mode….

When they could be running far more efficiently, with far clearer proof of the value they’re delivering.

#securityawareness #humanrisk #securityawarenesstraining #cybersecurity #metricsthatmatter

Phishing Impact Scientist | Boutique, highly specialized service proving behavioural change from scientific baselines | North Star Metrics to guide optimal security awareness programs

The best approach for effective Phishing Awareness bar none.

Less is more. 

Fact: A successful phishing awareness program must create behavioral change with common users. What impresses technical buyers is irrelevant.

Fact: Common users have limited appetite and limited cognitive load for security advice.

Fact: To drive behavioral change you have to measure impact objectively.

So, here are 3 steps that are completely contradictory to legacy approaches.

😊— 𝐒𝐢𝐦𝐩𝐥𝐢𝐟𝐲 𝐭𝐡𝐞 𝐃𝐞𝐟𝐢𝐧𝐢𝐭𝐢𝐨𝐧 𝐨𝐟 𝐏𝐡𝐢𝐬𝐡𝐢𝐧𝐠: Phishing is a scam that can be delivered through any communication channel (email, text, phone, social media etc…)

✅— 𝗦𝗶𝗺𝗽𝗹𝗶𝗳𝘆 𝘁𝗵𝗲 𝘁𝗿𝗮𝗶𝗻𝗶𝗻𝗴 — 𝗳𝗼𝗰𝘂𝘀 𝗼𝗻 𝗩𝗲𝗿𝗶𝗳𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝘀𝗸𝗶𝗹𝗹𝘀:
Verifying through another channel is the only thing hackers can not fake or manipulate. As phishing gets more sophisticated this skill becomes more important.

🔐— 𝐌𝐞𝐚𝐬𝐮𝐫𝐞 𝐈𝐦𝐩𝐚𝐜𝐭 𝐎𝐛𝐣𝐞𝐜𝐭𝐢𝐯𝐞𝐥𝐲: 
This is the key!! Use metrics from true baselines to measure incremental impact objectively. This foundation guides your program.

It is difficult to track impact without using baselines built with scientific rigour. This represents your North Star Metric to guide optimal program development.

If the approach is working, objective metrics will prove it.

So if it’s working, double down. If it’s not, change it up. 

Whether you have a SAT/HRM platform or not, it simply makes little sense to run a program blindly without the foundation of objective impact metrics. 

This is the biggest gap in the industry (See comments for research that proves this)

Important Notes: 

❌ Benchmarks are not Baselines! They do not measure impact. 

❌ Baselines are not merely the first test. This is a terribly flawed industry-driven assumption.

✅ Baselines isolate impact within 𝒚𝒐𝒖𝒓 organization 

Baselines require rigor: they create a stable, like-for-like starting point that isolates impact over time and is transparent and falsifiable.

Commercial platforms sell benchmarks only — NOT baselines. Benchmarks are one-off snapshot comparisons against other organizations. They are vertical disparate activity metrics, not proof of change. Baselines measure impact within your own organization longitudinally.

What do you think? Is it time to rethink the whole phishing training approach?

Is it time to start measuring impact properly to optimize agnostic commercial platforms ? 

#cybersecurity #securityawareness #phishing #phishingawareness

“Baseline” is easily the most abused word in Security Awareness.

It’s not just the measure of the first test — just because it was first.

A true baseline is a controlled, repeatable reference point.

#cybersecurity #metricsthatmatter #awarenesstraining

A simple, objective test to truly validate the impact of your security awareness or HRM platform

If you bought a security awareness platform after running their free phishing assessment (very common), here’s a practical way to see whether it has actually changed behaviour.

Step 1 – Reuse the original “free” simulation:
Find the exact same phishing template the vendor used for that initial free assessment.

Step 2 – Select a new group:
Choose a random group of about 100 employees who:
• Have been in your awareness program for a while, but
• Have never received that exact simulation before.

Step 3 – Run the campaign again after 6 months. Then again after 1 year to a third randomly selected group of a different 100.

Now compare:
	•	How does the click rate compare to the original free assessment?
	•	Is it meaningfully better after training?
	•	Is it in line with the platform’s marketing claims? (Should be close to a 90% reduction at 12 months to match claims)

If the numbers haven’t really moved, or aren’t close to what the platform claimed, that tells you something important about impact — because most vendor metrics are designed to only prove activity, not effectiveness.

———————————————————

What’s actually happening here?

Doing this exercise turns the results of your free test into a true baseline (aka — a true reference point)

  • Not a vendor’s self-assessed dashboard metrics (which are easy to influence by changing templates, difficulty, or targeting),
  •  Not another snapshot benchmark comparison to others which can’t isolate impact within your own organization 
  • But a controlled re-use of the same scenario on fresh groups, after your program has been running.

That’s a very simplified example of scientific rigour.

Scientific rigour is the disciplined methodology that makes results credible, reproducible, and unbiased.

Security awareness needs more of this kind of testing if we’re serious about proving real behavioural change over time.

This example of reusing the “free” simulation is just the tip of the iceberg regarding the type of work I do here as a data scientist.

A genuinely valuable measurement framework uses a much more extensive methodology: true baselines and longitudinal analysis that all rely on objective, falsifiable metrics. (Undeniable proof that can’t be spun into security theater)

My more extensive framework doesn’t just give you a couple of one-off baseline comparisons. It gives you what’s actually missing in most programs — an ongoing measurement framework that tracks true baselines over time and shows incremental impact objectively on a regular cadence (monthly, bi-monthly, or quarterly). It becomes a constant guide for how you design, tune, and justify your awareness program.

#metricsthatmatter #securityawareness #phishing #humanriskmanagement

Phishing simulations aren’t the problem.
How we use them is.

SAT and HRM platforms actually have huge potential. The issue is how success is measured.

Right now, most platforms are allowed to both run the training and define the metrics that “prove” it works. That’s exactly how we ended up with phishing simulations being treated mainly as a content delivery engine:

—More templates
—More “Gotcha” supplemental training content
—More activity for everyone

…with “success” defined by the same dashboards that exist to justify more of the above. 

This only serves the vendor - while building a culture of resentment.

It doesn’t respect employees’ time, and it often feels like punishment rather than support.

I’d argue phishing simulations should primarily be used as a data-science-driven measurement framework, not just a way to push more content:

Used as controlled experiments, with proper baselines, they can:

•  Objectively prove whether awareness is actually improving over time
•  Identify the small subset of people who are consistently vulnerable (often ~15%)
•  Ease the burden on the majority who clearly don’t need more training cycles

In my own work as a phishing impact scientist, that’s been the focus:
flipping the model so simulations are designed first as measurement tools, and only second as training touchpoints.

SAT and HRM platforms can absolutely deliver real value.
But we only unlock their true potential when we stop letting them be the sole source of “proof” and start treating phishing simulations as what they could be:

A rigorous, human-centred measurement framework….
not just another way to shovel more content at people.

#phishingsimulation #phishing #cybersecurity #securityawareness #humanrisk

taplio

The Battle

Dr. Tammie Hollis

Cary Johnson

Followers

Posts

Engagements

Likes

Performance ScoreCary Johnson's LinkedIn Performance

Ready to grow your LinkedIn presence?

taplio

The Battle

Dr. Tammie Hollis

Cary Johnson

Followers

Posts

Engagements

Likes

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Cary Johnson's LinkedIn Performance

Ready to grow your LinkedIn presence?

Performance ScoreCary Johnson's LinkedIn Performance