A security programme is only as strong as the behaviours of the people it depends upon, and those behaviours are shaped far more by culture than by policy.
Why This Tenet Matters #
Technology and process can take an organisation a considerable distance toward security maturity, but they cannot close the gap that only human behaviour can bridge. Phishing succeeds because people click. Data is lost because employees make poor judgements under pressure. Incidents go unreported because individuals fear the consequences of raising concerns. A security culture that is honest, open, and genuinely empowering addresses these vulnerabilities at their root, creating an environment where secure behaviour is the norm rather than the exception, and where the security team is seen as a partner in everyone’s success rather than an authority to be navigated or avoided. Without this foundation, even the most sophisticated technical controls will be undermined by the human layer they depend upon.
Core Concepts #
Understanding Security Culture #
Security culture refers to the shared values, attitudes, and behaviours that determine how an organisation’s people think about and act on security in their daily work. It is distinct from security awareness, which is primarily about knowledge, though the two are complementary. A strong security culture means that individuals across the organisation internalise security as a personal responsibility, exercise sound judgement in ambiguous situations, and feel both empowered and obligated to raise concerns without fear of negative consequences.
The Case for Honesty and Psychological Safety #
Honest culture is a specific and important dimension of this. It refers to an environment in which people feel safe to report mistakes, near misses, and genuine uncertainties without fear of blame or retribution. Organisations that punish security failures, however unintentionally, train their people to conceal them, which is far more dangerous than the original mistake. The ISO who builds a culture of psychological safety around security creates an early warning system that no technology can replicate.
Empowerment Over Compliance #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
