European Cyber Security Month - Feedback loops
@channel Last week, we talked about the importance of a full Communications Plan for your Security Awareness Month. After all, security programmes are built to push messages out - training, education, policy updates. What we may not be so good at is listening 🙉.
That imbalance sits at the centre of security culture work: we measure click rates and completion percentages and call it engagement, but true engagement isn't one-directional 🔃. If we want people to believe security is done with them, not to them, we have to value listening as much as broadcasting.
Consider the difference between two scenarios:
- 1.
A mandatory module is pushed to all staff telling them about a new process or policy;
- 2.
A question is issued to all staff - “what gets in your way when you try to report a security concern?”
Only the second suggests their experience matters enough to shape what happens next. Employees don't conclude “security cares about us” because of a well-produced campaign; they conclude it because, at some point, they said something was broken and we fixed it ✅. Without that loop, even the best-designed awareness content reads as friction from someone who doesn't care 🤷♂️.
The trouble is, one channel can't do this job. 👩💼Executives rarely respond to a survey - listening to them means being in the room; 🧑🏭 Operational staff live with legacy technologies that resist changes, so we need to walk the floor, not just email a policy; and 🧑💼Office workers leave a trail in help desk tickets and everyday grumbling about workplace process frictions that quietly drive workarounds. Treating all three as one audience is how we lose the connection, and the trust, we're trying to build.
Collecting feedback is the easy part. What changes behaviour and creates culture is visibly acting on it. A control adjusted because the factory floor flagged it as unworkable, or a reporting process simplified because people kept giving up halfway through - these are the moments that convert feedback into evidence of care.
A feedback loop that goes nowhere is worse than none at all ⏯️- it teaches people not to bother. If users don't get a valid, personalised response to every suspicious email they report, they'll simply stop.
Security culture isn't something a campaign announces into existence. It accumulates as the residue of hundreds of small moments where the organisation either responded to what people told it, or didn't. The key question isn't how to communicate security better - it's how well we listen, and what we're prepared to change because of what we hear 👂.
So, during Security Awareness Month, capture the voices, feedback and complaints from each person, and record who said what. Investigate, and circle back with personalised responses and explanations. We may not fix everything, but if people understand how, why and when, that's the basis for trust 🫶.
Get a First Look at What’s Coming to Signal 2026
@channel Less than two months to go until we meet in Cologne on November 18 and there’s already a first taste of what’s waiting for us.
The official Signal 2026 trailer is out, giving us a glimpse of the people, conversations and ideas coming together this year.
From AI and cyber resilience to security culture, human behaviour and the realities of leading security teams, Signal 2026 brings together voices from across the security landscape for a full day of ideas, conversations and practical insights.
We’re already getting things started here in the Community, with more opportunities to connect, exchange and get ready for Signal together.
