We believe people make organisations more resilient when risk-aware working becomes second nature
Technology and processes are essential to information security and are only truly effective when people recognise risks and make secure choices. Employees handle information, use systems and make daily decisions that strengthen or weaken an organisation’s resilience.
Our mission is to relieve organisations of the burden of managing security awareness and behaviour, so that a culture emerges in which risk-aware working becomes second nature. This requires more than e-learning modules, standalone training, phishing tests or an annual campaign. Only by understanding business risks, behaviour and programme maturity.
We therefore developed Bright®: our approach to systematically developing, measuring and embedding risk-aware behaviour. Bright® comprises four interconnected phases: Assess, Educate, Direct and Sustain.
The Bright Security Awareness Management System (SAMS) supports the approach through its integrated control framework and maturity model. This enables us to assess how mature an organisation is in governing, delivering and improving security awareness. We examine governance, responsibilities, processes, measurement, intervention design and planning, and programme embedding across four levels: Ad hoc, Awareness, Behaviour and Culture.
We combine these insights with risk workshops, interviews, simulations, behavioural data, and cyber skills and cyber culture surveys. Our persona-based approach provides the consistent thread: we distinguish target groups by role, context and risk profile, allowing risks and data to determine where and how interventions will have the greatest impact.