All Things Human Risk Management

Episode #12 Many security awareness programs eventually hit a plateau. Training completion rates look healthy. Phishing numbers aren’t terrible. But progress stalls. Engagement drops. And leadership starts asking a difficult question: are we actually changing behavior? In this episode, Eliot is joined by Anthony Davis , a security awareness leader with more than a decade of experience building and...

Episode #11 Using real breach stories in security training works... but only if you do it ethically. Real incidents make threats feel concrete, cut through “this would never happen to me” thinking, and drive behavior change. But they also carry real risk: victim-blaming, fearmongering, reputational harm, and loss of trust if handled poorly. In this episode, Noora is joined by David Badanes (Human...

Episode #10 Email security filters have never been better... and yet attackers are still getting through. In this episode, host Eliot is joined by Petri Kuivala (CISO advisor) and David Badanes (Human Risk Management advisor) to break down what actually makes it past modern defenses, based on analysis of 400,000 real attacks reported by users - not simulations, not theory. They unpack how generati...

Episode #9 “Security awareness training doesn’t work” makes for a punchy headline. But is the problem training itself - or the way most organizations still run compliance-driven, once-a-year programs? In this episode, host Eliot Baker sits down with global security awareness leader David Badanes to dissect the latest “training fails” narratives (especially the UC San Diego study amplified by the W...

Episode #8 Security leaders don’t need more headlines - they need inbox reality: what bypasses filters, what people click, and where to train next. In this episode, host Eliot Baker sits down with Maxime Cartier , Hoxhunt’s Head of Human Risk Management, , to unpack the State of Phishing 2025 : why SVG attachments spiked, what still works, how the Microsoft vs. Google stack changes the threat mix,...

Episode #7 Security leaders don’t need more slides - they need messages that move budgets, influence behavior, and reduce risk. In this episode, host Eliot Baker sits down with CISO and author ⁠Jeffrey Brown⁠ to unpack a practical security communications playbook: metrics with a job, and how to build a report-button culture without blame. What you’ll learn in this episode: How to use Bottom Line U...

Episode #6 “Trust the pause, not the voice.” Voice clones and live-meeting deepfakes have collapsed the gap between “that would never happen here” and “finance just sent the wire.” In this episode, host Eliot Baker sits down with Dr Jessica Barker MBE to discuss her book , 'Hacked' and to dissect two escalating threats - virtual kidnaps by voice clone and executive impersonation on Teams/Z...

Episode #5 “We have 100% completion… but nothing’s changed.” It’s a complaint security leaders are making louder and more often. Completion rates are being called “cosmetic,” “misleading,” and “just optics” - metrics that check the compliance box but fail to reduce real human risk. In this episode, host Eliot Baker sits down with Maxime Cartier , Head of Human Risk at Hoxhunt, to unpack what organ...

Episode #4 AI might be transforming cybersecurity… but not always in the way vendors want you to believe. In this episode, Eliot Baker sits down with Hoxhunt CTO and Co-founder Pyry Åvist to expose what’s actually happening at the front lines of the AI-powered phishing threat. No speculation. Just real research, real data, and real implications for your defense strategy. Together, they unpack how...

Episode #3 Should We Punish Employees for Security Mistakes? Eliot is joined by Noora Ahmed-Moshe VP of Strategy & Operations, Hoxhunt) for a discussion on one of cybersecurity’s most divisive questions: should repeat offenders in training programs be punished... or is there a better way? Leveraging on behavioral science, real-world case studies, and Noora’s global experience advising security...

Episode #2 RSA 2025 was full of AI claims - but what were security leaders really worried about? Eliot is joined by ⁠ Noora Ahmed-Moshe ⁠ (VP of Strategy, Hoxhunt) for a no-spin debrief on RSA 2025. With AI hype at full volume and booth gimmicks ranging from goats to deepfake demos, it’s easy to miss the real signals in the noise. Eliot and Noora cut through the chaos to unpack what security leade...

Episode #1 Are your security awareness metrics actually measuring risk reduction? Or just checking boxes? Eliot is joined by Maxime Cartier (Head of Human Risk, Hoxhunt) to break down what truly works it when it comes to reducing human cyber risk. Maxime has spent close to 10 years helping organizations elevate security awareness into human-centered risk management and led security culture initiat...