David Shultz develops cybersecurity awareness campaigns at Sans Serif, using marketing and creative strategy to encourage behavior change rather than relying on off-the-shelf training modules.
Awareness training targets the wrong mental state · Segment by circumstance, not job title · Bespoke behavior-change campaigns, not off-the-shelf training modules
David Shultz develops cybersecurity awareness campaigns at Sans Serif, where the stated approach uses marketing and creative strategy to encourage behavior change rather than relying on off-the-shelf training. Their LinkedIn posts share reflections from cybersecurity conferences, connecting other practitioners’ research and examples to questions about how awareness campaigns should work.
Shultz turns conference ideas into practical questions about campaign design.
After NCA’s Convene, they challenged audience segments based mainly on job role or location, highlighting personal circumstances and the mismatch between calm training and threats that arrive during a busy or stressful moment.
Their SANS Summit recap adds a useful counterweight: personalization may help, but tailoring messages across many employee characteristics raises accuracy and quality-control concerns.
That combination—questioning standard practice while acknowledging implementation trade-offs—makes their posts useful to readers thinking through cybersecurity behavior change.
Shultz argues that cybersecurity awareness work fails when it treats audiences and training moments as uniform.
Read more
Across conference recaps, Shultz makes the case for defining risk by personal circumstance and cognitive state, not job title; building bespoke behavior-change campaigns instead of standard training modules; and recognizing that personalization has a practical ceiling. Shultz also turns conference insights into named, attributed takeaways and tests them against what a campaign can actually control.
Awareness training targets the wrong mental state
Shultz argues that awareness programs assume calm, undistracted attention, while real attacks land mid-task.
Read more
Shultz credits Pooja Srivastava and Perry Carpenter with naming a gap that had gone overlooked for years: people are trained in slow-brain mode and attacked in fast-brain mode.
The argument closes with a question, not a technique: if the threat arrives at speed, shouldn’t the training, too?
It’s the sharpest expression of Shultz’s behavior-change position and points to campaign design, not content volume.
The Convene in Boston recap draws the contrast directly: training happens when someone is calm, seated and undistracted, while the threat arrives "mid-task, mid-crisis, mid-Tuesday."
Shultz arrived at NCA's Convene in Boston curious about audience segmentation and left questioning the standard slices: region, seniority, role, data access, on-site versus remote.
Read more
Shultz points to Dr.
Lorrie Cranor's research suggesting personal circumstances are stronger predictors of risk, including accessibility needs, time and resource pressure, and isolation—factors that never appear on an org chart.
The FUDGE framework discussed at the event—Fear, Urgency, Desire to please, Greed, Empathy—supports the argument that attackers target a person's state when a message lands, not their job title.
Shultz makes the point concrete with new hires, who may be eager to prove themselves, unsure of norms and without a baseline for what normal looks like.
The recap identifies new hires as a persona for whom the FUDGE factors line up almost automatically, rather than recommending a generic "all employees" campaign.
Shultz describes a shift over a single trip: arriving curious about segmentation and leaving questioning the whole traditional approach.
Bespoke behavior-change campaigns, not off-the-shelf training modules
Shultz positions cybersecurity awareness as a core specialization at Sans Serif, bringing a marketing and creative strategy lens.
Read more
The case: build campaigns around behavior change for a specific organization, rather than buy catalogue training.
To illustrate the approach, an associate creative director and a client jointly presented a large-scale campaign they had built at the Clearwater Convene.
Shultz describes feedback from the expert audience as a way to sharpen the work in real time.
At Convene in Clearwater, a client and agency jointly presented a large-scale awareness campaign they had built and tested in front of practitioners.
Shultz treats segmentation as a tradeoff, not a technique to adopt wholesale.
Read more
In the SANS Security Awareness Summit recap, Shultz considers how AI could cross-reference role, generation, seniority, knowledge level, data access, region, language, travel exposure and test scores to send every employee a unique message.
But accuracy and quality control set the limits, putting the practical answer between one-size-fits-all and complete personalization.
Shultz applies the same reasoning to competition: a mechanic built on Big Ten rivalries worked there, but competition does not work in every culture.
It’s a natural fit, not a universal tactic.
In a lightning talk, Cynthia McKendall and Kendall R Williams used pre-existing Big Ten collegiate rivalries to drive a cybersecurity behavior-change competition between universities. Shultz highlights the example while noting its limits.
Shultz uses the awareness conference circuit as a source of current practice, turning events into short, structured recaps: speakers followed by numbered takeaways.
Read more
The recaps name sessions and speakers, including Erin West on the scale of international organized cybercrime and Casie Clark and Charlotte Jupp on segmentation, and link to the organizations mentioned. Recent stops include Convene in Boston and Clearwater, the SANS Institute Security Awareness Summit in Chicago, RSA, and a client event in Las Vegas.
The Chicago summit recap presents three numbered highlights from named talks, each linked to a practical implication for awareness programs.
This post gives newcomers a view of Shultz's thinking on behavior-change design and a concrete critique of standard segmentation.
Read more
It shows how they connect conference research to practical questions about campaign strategy.
David Shultz went to NCA's Convene in Boston expecting to learn about segmenting audiences by region, seniority, role, data access and remote status.
The post explains why the approach left them questioning the traditional model.
Dr.
Lorrie Cranor's research suggests personal circumstances—accessibility needs, time and resource pressure, isolation—are stronger predictors of vulnerability than job title.
Shultz also describes the FUDGE framework (Fear, Urgency, Desire to please, Greed, Empathy) from Steven M.
M. and a gap identified by Pooja Srivastava and Perry Carpenter: training happens in slow-brain mode, calm and undistracted, while threats arrive in fast-brain mode, mid-task or mid-crisis.
Shultz ends with a direct question: if the threat arrives at speed, shouldn't the training?
For brands planning a campaign
For a cybersecurity awareness training company, this post frames a session on segmentation and fast-brain threat response. Shultz's takeaways can shape a talk that challenges conventional demographic slices and offers alternative risk factors: personal circumstances, cognitive state and specific vulnerable groups such as new hires.
This post shows how Shultz draws practical lessons from conference talks, including a specific example of segmentation trade-offs.
Read more
They frame the recurring question of how much to segment against real constraints.
Shultz shares three highlights from the SANS Institute Security Awareness Summit in Chicago: Erin West on the scale of international organized cybercrime; Cynthia McKendall and Kendall R Williams on using Big Ten collegiate rivalries to motivate cybersecurity behavior-change competition between universities; and Casie Clark and Charlotte Jupp on segmentation.
On the third point, Shultz notes that organizations often send the same communication to everyone, even though recipients vary by role, generation, seniority, knowledge level, access to confidential data, region, language, travel exposure, work environment and testing scores.
They wonder whether AI could cross-reference those fields for personalization, but say accuracy and quality control seem tricky.
The answer, they conclude, lies somewhere between one-size-fits-all and completely personalized.
For brands planning a campaign
Supports a session or consulting on segmentation, with concrete examples and an acknowledgement of the practical limits of personalization. The Big Ten rivalry example also offers a ready-made case study for behavior-change campaigns that draw on existing group identities.
This is the clearest statement in Shultz's posts of their professional context and the campaign philosophy behind the work.
Read more
Newcomers get both the positioning—bespoke campaigns focused on behavior change—and an example of prior public speaking with client co-presenters.
Shultz registered for Convene in Boston and looks forward to returning.
They attended the March iteration in Clearwater, where an associate creative director and a client jointly presented a large-scale cybersecurity awareness campaign they built together.
Shultz describes cybersecurity awareness as one of Sans Serif's core specializations, approached through marketing and creative strategy: bespoke campaigns built around behavior change, not off-the-shelf training modules.
Conversations at events like Convene help the team keep sharpening that approach.
For brands planning a campaign
Directly relevant to a brief seeking a speaker or consultant for a behavior-change campaign. The post demonstrates Shultz's positioning, prior joint presentation experience and a creative-strategy-first method that differs from off-the-shelf training.
Bespoke behavior-change campaigns over off-the-shelf modules1
Where segmentation stops being worth it1
Audience segmentation beyond org-chart categories
Shultz's recap of NCA Convene in Boston opens with questions about segmenting cybersecurity awareness audiences and closes by challenging the usual slices — region, seniority, role, data access, on-site versus remote.
Read more
They point to Dr.
Lorrie Cranor's research suggesting personal circumstances are stronger predictors of risk: accessibility needs, time and resource pressure, and isolation.
None appears on an org chart.
The FUDGE framework discussed at the event — Fear, Urgency, Desire to please, Greed, Empathy — explains how attackers target a person's state when a message lands, not their job title.
A second session, from Pooja Srivastava and Perry Carpenter, addresses a gap they say had been overlooked for years: awareness training happens in slow-brain mode, when people are calm and undistracted, while threats arrive in fast-brain mode, mid-task and mid-crisis.
The vulnerable personas become concrete, with new hires singled out as eager to prove themselves and lacking a baseline for what normal looks like.
For brands planning a campaign
This is the basis for a session on segmentation and fast-brain response: define audiences by circumstance rather than job title, then test whether training holds up under the conditions in which an attack arrives.
Bespoke behavior-change campaigns over off-the-shelf modules
Shultz describes cybersecurity awareness as one of Sans Serif's core specializations, approached through marketing and creative strategy: bespoke campaigns built around behavior change rather than off-the-shelf training modules.
Read more
They also note attending Convene in Clearwater, where an associate creative director and a client jointly presented a large-scale awareness campaign they had built together, and describe the room of experts as a source of real-time feedback.
For brands planning a campaign
Supports a brief for a custom campaign or creative strategy rather than a catalogue training product, and points to a working pattern of presenting campaign work jointly with the client.
In the SANS Security Awareness Summit recap, Shultz pushes back on full personalization.
Read more
AI could theoretically cross-reference role, generation, seniority, knowledge level, data access, region, language, travel exposure and test scores to send each employee a unique communication.
But they flag accuracy and quality control as constraints, placing the practical answer somewhere between one-size-fits-all and completely personalized.
A second summit takeaway, from Cynthia McKendall and Kendall R Williams, describes a cybersecurity behavior-change competition between universities that used pre-existing Big Ten collegiate rivalries.
Shultz notes that competition does not work in every culture and calls it a natural fit there, not a universal tactic.
Shultz treats a proposed technique as a tradeoff to assess rather than adopt wholesale: they describe what could be done, then identify the control problem that limits it.
Competition-based behavior change is framed as culture-dependent, not a default mechanic.
For brands planning a campaign
Useful for setting expectations in a brief: segment by persona and circumstance without promising per-employee personalization, and test competition mechanics against culture before building them in.
Across their posts, Shultz covers the cybersecurity awareness conference circuit — Convene in Boston and Clearwater, the SANS Institute Security Awareness Summit in Chicago, RSA, and a client event in Las Vegas — and writes up each event as a set of named takeaways.
Read more
Recaps credit specific speakers and sessions (Wendy Battles, Alison Harrington, Casie Clark, Charlotte Jupp, Erin West, Lisa Plaggemeier, among others) and link to the organizations mentioned.
Conference attendance becomes a short, structured recap — a slate of speakers followed by numbered takeaways — while the community around those events serves as a standing source of current practice.
For brands planning a campaign
A session or workshop can draw on current conference material and named sessions rather than evergreen talking points. The recaps also show a habit of crediting collaborators, useful when building a co-hosted session.
David Shultz’s LinkedIn posts document a work affiliation with Sans Serif, where they describe cybersecurity awareness as a core specialization, and attendance at events run by the National Cybersecurity Alliance, SANS Institute, and RSA.
Read more
A client event in Las Vegas is also mentioned, but the client is not named; ask for the client’s name if brand identification matters.
Sans Serif
Employment
Shultz’s post says cybersecurity awareness is “one of our core specializations at Sans Serif” and describes “our” approach to bespoke behavior-change campaigns, indicating they work with the agency.
Read more
The post does not state an ownership stake or job title.
Shultz attended the SANS Institute Security Awareness Summit in Chicago and later said they were headed to the SANS Institute Security, Awareness and Culture Summit in Las Vegas.
David Shultz’s posts read as a working notebook on cybersecurity awareness.
Read more
One recurring theme is audience segmentation: they argue that the usual cuts — region, seniority, role, data access, on-site versus remote — miss the stronger predictor of personal circumstance.
Awareness training, they say, happens in a calm, slow-brain state, while attacks arrive mid-task and mid-crisis.
Another theme is campaign craft: bespoke behavior-change work over off-the-shelf training modules, with the limits of personalization and competition mechanics stated rather than glossed.
Start with the Convene in Boston recap for the segmentation argument, then the SANS Chicago recap for where personalization stops being worth it.
For adjacent reading, Kevin Martin covers human risk management and simulation metrics from the vendor side; Sandra Cruz, PMP writes on customer trust and experience; Sam Curry writes on agentic AI, leadership, and cyber risk.
Kevin Martin’s posts cover a close break in the same field: security awareness training measured by simulation click rates does not map to who actually causes incidents.
Read more
They argue for aggregating identity, endpoint, credential-exposure, and real-threat signals into human risk profiles, a view that sits near Shultz’s argument that risk lives in circumstance and cognitive state rather than job title.
Martin writes from inside the Human Risk Management side of the market, using a staged CISO dialogue to challenge adaptive phishing simulations. Shultz focuses more on campaign design and conference practice, often testing ideas against what a creative team can control.
Sandra Cruz’s posts share Shultz’s focus on how trust is built or lost in human-facing communication.
Read more
Cruz uses Frances Frei’s Triangle of Trust — authenticity, logic, empathy — to discuss customer-facing teams, arguing that trust breaks when customers feel decisions are made to them rather than with them.
Cruz writes about customer success and customer experience leadership, framed by a Boston offsite and CCO Summit. Their posts do not address security awareness training, audience segmentation for cyber campaigns, or behavior-change mechanics.
Sam Curry’s posts also focus on cybersecurity and risk, connecting leadership practice to AI adoption.
Read more
They ask how accountability and predictability work when decisions come from a network of agents, a leadership-and-risk question that sits alongside Shultz’s concern with how people behave under pressure.
Curry focuses on agentic AI and enterprise security leadership, including a conversation with Richard Stiennon about what agentic AI means for society and cyber. Their posts do not cover security awareness campaign segmentation or creative behavior-change delivery.
David Shultz’s posts point to an audience of awareness practitioners and event communities, rather than a broad consumer audience.
Read more
They focus on conference takeaways from NCA Convene and the SANS Security Awareness Summit, with recurring attention to audience segmentation, behavior change, and fast-brain threat response.
That content fits a session aimed at awareness teams or campaign builders.
The only audience metric published in the posts is 1,339 LinkedIn followers as of October 9, 2026; it does not establish room draw or audience composition.
Before booking, ask for recent session outcomes or post performance on comparable topics—segmentation and fast-brain threat response—and formats.
To assess audience composition by employer, occupation, or seniority, ask whether Shultz has survey results or another documented source.
LinkedIn followers
1,339
LinkedIn profile snapshot in the account record · 2026-10-09
David Shultz works through Sans Serif, where cybersecurity awareness is described as a core specialization.
Read more
The agency builds bespoke campaigns around behavior change rather than off-the-shelf training modules.
A large-scale awareness campaign was presented jointly by a Sans Serif associate creative director and a client at the National Cybersecurity Alliance's Convene in Clearwater.
A later post refers to returning to Las Vegas for a major client event.
Brands considering a speaker or consultant for a behavior-change campaign should confirm the format, availability, and commercial terms directly with the agency.
Bespoke awareness campaign development
Buyer requirement
Work is positioned as marketing and creative strategy rather than a standard training package.
Campaign briefs should name the target behavior and audience conditions instead of requesting a generic module.
Ask Sans Serif directly about scope, pricing, and turnaround terms.
Speaking and joint presentation at industry events
Buyer requirement
A completed campaign was presented at a National Cybersecurity Alliance event by a Sans Serif associate creative director and the client, so brands should plan for joint delivery rather than a handoff.
Shultz attends cybersecurity awareness conferences, and the posts reflect that community.
Ask about speaking fees, booking, and availability.
For a cybersecurity awareness training company seeking a speaker or consultant on behavior change, David Shultz is a strong fit for a session on audience segmentation and fast-brain threat response.
Read more
Their posts show current, specific thinking on the problem.
They question the usual segmentation slices—region, seniority, role, data access, on-site versus remote—and point to Dr.
Lorrie Cranor’s research that personal circumstances such as accessibility needs, time and resource pressure, and isolation are stronger predictors.
They connect that research to the FUDGE framework (Fear, Urgency, Desire to please, Greed, Empathy) and to the gap identified by Pooja Srivastava and Perry Carpenter: training happens in slow-brain mode while threats arrive in fast-brain mode, mid-task or mid-crisis.
New hires are one concrete vulnerable persona.
The commercial format also suits a cybersecurity awareness campaign: Shultz describes cybersecurity awareness as a core specialization at Sans Serif, approached as bespoke behavior-change campaigns rather than off-the-shelf modules, and cites a joint presentation with an associate creative director and a client at Convene in Clearwater.
Before booking, ask Sans Serif to confirm availability, comparable session outcomes, fee, audience draw, seniority, geography, engagement, and booking route; their posts show 1,339 LinkedIn followers as of October 9, 2026.
When to choose a specialist
For a consumer cybersecurity or fintech app seeking a high-volume, creator-led product launch—paid social video, app-install reach, and fast-turnaround promotional content—David Shultz is a poor fit based on their posts.
Read more
The posts feature conference recaps and agency campaign-strategy commentary aimed at awareness practitioners, not consumer product promotion.
The only audience metric is 1,339 LinkedIn followers as of October 9, 2026.
The posts do not document a video format, consumer engagement rate, audience demographic, rate card, or booking route.
The work described is custom campaign development and joint industry-event presentation, not a high-reach direct-response format.
There is another material mismatch: if the campaign requires hands-on technical security engineering or penetration-testing instruction, the posts show strategic and creative awareness work, not technical training.
Choose a different creator, or consider Shultz only for a much narrower role.
A worked campaign example
Brief: a cybersecurity awareness training company wants an expert speaker or consultant for a behavior-change campaign and a session on audience segmentation and fast-brain threat response.
Proposed angle—‘From org chart to moment of risk.’ 1) Pre-work with the client: gather existing segmentation fields, training completion data, and any scenario-response or reporting metrics; ask Sans Serif for David Shultz’s availability, fee, and whether the delivery is a keynote, workshop, or consulting engagement.
2) Session structure: open by testing the usual slices—region, seniority, role, data access, remote status—then introduce the personal-circumstance frame from Dr.
Lorrie Cranor’s research, as discussed by Shultz (accessibility needs, time and resource pressure, isolation).
Use the FUDGE framework to show that attackers target a person’s state, not their job title.
Then make the slow-brain/fast-brain gap the center of the session, using the point Shultz credits to Pooja Srivastava and Perry Carpenter: training is calm and seated, while threats arrive mid-task and mid-crisis.
Close with a segmentation exercise that selects two or three circumstance-based personas, including new hires as one concrete example.
3) Campaign angle: rebuild the training around short, interruptive practice moments that mimic fast-brain conditions, rather than one annual module.
Test whether the message holds when someone is busy, stressed, or isolated.
Apply Shultz’s caution about personalization: aim between one-size-fits-all and fully individualized communication, because accuracy and quality control get hard.
If the client wants a competition mechanic, treat it as culture-dependent, using the Big Ten rivalry example as a conditional case rather than a default.
4) Delivery pattern: Shultz’s disclosed example was a joint presentation by a Sans Serif associate creative director and the client at Convene in Clearwater, so plan for joint delivery or co-presentation rather than a handoff.
5) Measurement: agree on a scenario-response or decision-quality measure, not just completion.
Confirm the fee, availability, session length, audience draw beyond followers, and whether Shultz will present, facilitate, or consult.
Kevin Martin is a better choice for a campaign focused on measuring and reducing human risk than on designing a segmented awareness campaign.
Read more
The posts argue that phishing-simulation click rates do not correlate with who causes incidents and that programs should combine identity, credential-exposure, endpoint, training and real-threat-response signals into ranked risk profiles and proactive interventions. For a security awareness training company seeking a session that challenges program metrics and advances Human Risk Management, Martin's posts are closer to that brief than Shultz's segmentation and fast-brain framing.
The tradeoff is scope and format.
Martin's posts make a program-category and industry-shift argument but offer no comparable detail on audience segmentation by personal circumstances, creative-campaign development or joint client presentations.
Buyers should expect a focus on human risk management and measurement; ask whether they also need a creative or segmentation specialist to deliver the behavior-change campaign.
Sam Curry is a better choice for a campaign seeking an executive-level cybersecurity and AI strategist rather than an awareness-campaign practitioner.
Read more
The posts address agentic AI, accountability for non-human team members, predictability in non-deterministic systems, and AI's security and societal implications. For a security awareness training company whose campaign must account for AI-driven threats and leadership questions, Curry offers a more senior technical and strategic frame than Shultz's session on segmentation and fast-brain threat response.
The tradeoff is distance from training and behavior change.
The posts offer strategic commentary and a podcast conversation, but no examples of audience segmentation, awareness-program design or fast-brain and slow-brain teaching.
Hiring Curry would likely produce a keynote on AI and cyber risk, not a practical workshop on segmenting awareness communications or redesigning training moments.
The client may need to pair Curry with an awareness specialist.
Sandra Cruz, PMP is a better choice for a campaign focused on customer trust and customer-facing team behavior, especially as AI changes how customers judge authenticity, logic and empathy.
Read more
The posts describe moderating a customer-facing trust session and applying a trust framework—authenticity, logic, empathy—to customer experience and AI-driven change. For a security awareness training company seeking to improve how its client-facing or customer-success teams build trust, Cruz's posts are closer to that task than Shultz's security-specific segmentation and threat-response session.
The tradeoff is domain fit.
The posts do not cover cybersecurity awareness, threat response or security-specific audience segmentation.
Buyers choosing Cruz for a security awareness behavior-change campaign will need to translate a customer-trust framework into a security context.
Ask whether they also need a security subject-matter expert to cover fast-brain threat response and phishing or credential-risk scenarios.
David Shultz's five LinkedIn posts describe cybersecurity awareness conference attendance and campaign work: NCA Convene in Boston and Clearwater, the SANS Institute Security Awareness Summit in Chicago, RSA, and a client event in Las Vegas.
Four posts are event recaps; one describes Sans Serif's approach to building bespoke behavior-change campaigns.
Three adjacent creators appear as comparison reading, not as sources on Shultz.
The posts have no publication dates, so no chronology is stated, and the follower figure is from an account snapshot dated October 9, 2026.
Shultz's posts do not say whether they have books, a show, or earlier career work that also explains name searches, and the posts publish no fee, availability, booking route, session draw, or audience-demographic data.