# David Shultz

David Shultz develops cybersecurity awareness campaigns at Sans Serif, using marketing and creative strategy to encourage behavior change rather than relying on off-the-shelf training modules.

- Profile: https://b2binfluencer.marketing/creators/david-shultz/
- LinkedIn: https://www.linkedin.com/in/davidlpshultz
- LinkedIn followers: 1,339
- Topics: cybersecurity
- Based on 11 dated posts, latest 2026-09-28

## Summary

David Shultz is most useful for cybersecurity awareness campaign thinking, especially audience segmentation and behavior change.

- Best for: A cybersecurity awareness training company seeking a speaker or consultant on campaign design and behavior change.
- Not for: Consumer cybersecurity or fintech app launches needing paid social video, app-install reach, or fast promotional content.
- Check first: Confirm availability, comparable session outcomes, fee, audience draw, seniority, geography, engagement, and booking route.

### Takeaways

- Awareness training happens in slow-brain mode while threats arrive in fast-brain mode.
- Segment by personal circumstances, not job role or location.
- Personalization may help but raises accuracy and quality-control concerns.

## Main ideas

- **Awareness training targets the wrong mental state**: Shultz argues that awareness programs assume calm, undistracted attention, while real attacks land mid-task. Shultz credits Pooja Srivastava and Perry Carpenter with naming a gap that had gone overlooked for years: people are trained in slow-brain mode and attacked in fast-brain mode. The argument closes with a question, not a technique: if the threat arrives at speed, shouldn’t the training, too? It’s the sharpest expression of Shultz’s behavior-change position and points to campaign design, not content volume.
- **Segment by circumstance, not job title**: Shultz arrived at NCA's Convene in Boston curious about audience segmentation and left questioning the standard slices: region, seniority, role, data access, on-site versus remote. Shultz points to Dr. Lorrie Cranor's research suggesting personal circumstances are stronger predictors of risk, including accessibility needs, time and resource pressure, and isolation—factors that never appear on an org chart. The FUDGE framework discussed at the event—Fear, Urgency, Desire to please, Greed, Empathy—supports the argument that attackers target a person's state when a message lands, not their job title. Shultz makes the point concrete with new hires, who may be eager to prove themselves, unsure of norms and without a baseline for what normal looks like.
- **Bespoke behavior-change campaigns, not off-the-shelf training modules**: Shultz positions cybersecurity awareness as a core specialization at Sans Serif, bringing a marketing and creative strategy lens. The case: build campaigns around behavior change for a specific organization, rather than buy catalogue training. To illustrate the approach, an associate creative director and a client jointly presented a large-scale campaign they had built at the Clearwater Convene. Shultz describes feedback from the expert audience as a way to sharpen the work in real time.
- **Personalization has a practical ceiling**: Shultz treats segmentation as a tradeoff, not a technique to adopt wholesale. In the SANS Security Awareness Summit recap, Shultz considers how AI could cross-reference role, generation, seniority, knowledge level, data access, region, language, travel exposure and test scores to send every employee a unique message. But accuracy and quality control set the limits, putting the practical answer between one-size-fits-all and complete personalization. Shultz applies the same reasoning to competition: a mechanic built on Big Ten rivalries worked there, but competition does not work in every culture. It’s a natural fit, not a universal tactic.
- **Conference takeaways as a working method**: Shultz uses the awareness conference circuit as a source of current practice, turning events into short, structured recaps: speakers followed by numbered takeaways. The recaps name sessions and speakers, including Erin West on the scale of international organized cybercrime and Casie Clark and Charlotte Jupp on segmentation, and link to the organizations mentioned. Recent stops include Convene in Boston and Clearwater, the SANS Institute Security Awareness Summit in Chicago, RSA, and a client event in Las Vegas.

## Work to read

- [Questioning standard audience segmentation after NCA Convene](https://www.linkedin.com/posts/davidlpshultz_i-went-to-ncas-convene-in-boston-curious-activity-7494547301034520576-ooCe)
- [Three takeaways from the SANS Security Awareness Summit](https://www.linkedin.com/posts/davidlpshultz_another-valuable-sans-institute-security-activity-7365201106446004225-GJdk)
- [Sans Serif's approach: bespoke cybersecurity awareness campaigns](https://www.linkedin.com/posts/davidlpshultz_i-just-registered-for-convene-in-boston-activity-7483271592513257472-C1qV)

## Brand relationships

- **Sans Serif** (employment)
- **National Cybersecurity Alliance** (mention)
- **SANS Institute** (mention)
- **RSA** (mention)

## Partnerships

David Shultz works through Sans Serif, where cybersecurity awareness is described as a core specialization. The agency builds bespoke campaigns around behavior change rather than off-the-shelf training modules. A large-scale awareness campaign was presented jointly by a Sans Serif associate creative director and a client at the National Cybersecurity Alliance's Convene in Clearwater. A later post refers to returning to Las Vegas for a major client event. Brands considering a speaker or consultant for a behavior-change campaign should confirm the format, availability, and commercial terms directly with the agency.

## Alternatives

- Kevin Martin: Kevin Martin is a better choice for a campaign focused on measuring and reducing human risk than on designing a segmented awareness campaign. The posts argue that phishing-simulation click rates do not correlate with who causes incidents and that programs should combine identity, credential-exposure, endpoint, training and real-threat-response signals into ranked risk profiles and proactive interventions. For a security awareness training company seeking a session that challenges program metrics and advances Human Risk Management, Martin's posts are closer to that brief than Shultz's segmentation and fast-brain framing.
- Sam Curry: Sam Curry is a better choice for a campaign seeking an executive-level cybersecurity and AI strategist rather than an awareness-campaign practitioner. The posts address agentic AI, accountability for non-human team members, predictability in non-deterministic systems, and AI's security and societal implications. For a security awareness training company whose campaign must account for AI-driven threats and leadership questions, Curry offers a more senior technical and strategic frame than Shultz's session on segmentation and fast-brain threat response.
- Sandra Cruz, PMP: Sandra Cruz, PMP is a better choice for a campaign focused on customer trust and customer-facing team behavior, especially as AI changes how customers judge authenticity, logic and empathy. The posts describe moderating a customer-facing trust session and applying a trust framework—authenticity, logic, empathy—to customer experience and AI-driven change. For a security awareness training company seeking to improve how its client-facing or customer-success teams build trust, Cruz's posts are closer to that task than Shultz's security-specific segmentation and threat-response session.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/