# Mark Brown

Mark Brown writes about applying behavioural science to cybersecurity, using real security incidents to explain why people and workplace processes create risk—and how organisations can design better safeguards.

- Profile: https://b2binfluencer.marketing/creators/mark-brown/
- LinkedIn: https://www.linkedin.com/in/markbrownpsybersafe
- LinkedIn followers: 2,150
- Topics: artificial-intelligence, cybersecurity, social-engineering
- Based on 11 dated posts, latest 2026-10-07

## Summary

Mark Brown is most useful for explaining security incidents through behavioural science and pointing to practical process safeguards.

- Best for: A cybersecurity training company seeking credible thought leadership on human risk and social engineering.
- Not for: Mass-reach consumer awareness, campaigns judged by reach and paid amplification, or product launches needing technical testing.
- Check first: Confirm audience demographics, recent post-level results, and whether they accept commercial work.

### Takeaways

- In offboarding, HR and IT each assumed the other owned the task.
- Brown uses diffusion of responsibility to explain why naming an owner matters.
- Patch automation uses staged rollouts and halt conditions to build judgement into the process.

## Main ideas

- **Security failures are design failures, not lapses in vigilance**: Mark Brown consistently rejects the explanation that people were careless. The HR malware campaign is framed as a failure of environmental design rather than vigilance: behaviour was triggered before any suspicious signal appeared. The offboarding incident is a process problem, not a technical one: revoking a login takes seconds, and the real gap was a job nobody owned. Patch automation is a system with no moment designed for checking. The priority is always the same: redesign the prompt, approval step or verification habit, and stop treating awareness as the fix.
- **Brown explains incidents through a small, repeated set of behavioural models**: The method is consistent enough to be a signature: take an incident or a published industry argument, name the study or model that explains why people behaved as they did, then translate it into a control. BJ Fogg's behaviour model, where motivation, ability and a prompt have to converge, is the main tool, used for both the HR malware campaign and patch automation. Omission bias, drawn from a 1990 study by psychologists Ilana Ritov and Jonathan Baron, explains why defenders hesitate to act. Diffusion of responsibility explains the offboarding gap. The predictable structure helps readers see how they reason, not just what they conclude.
- **Defenders hesitate because organisations punish visible mistakes more than invisible ones**: Responding to a National Cyber Security Centre blog, Mark Brown takes up the argument that attackers and defenders do not face the same conditions. An attacker's automated agent has a clear finish line: the exploit either works or it does not. A defender's agent has to weigh whether a patch will take down the VPN, whether a firewall rule will break something finance depends on, and who answers for it if it does. Brown highlights the board's perspective: some members see little difference between an attacker taking IT down and the security team doing it by accident, except that the board cannot shout at an attacker over the phone. The conclusion is that automating low-risk defensive actions only works if leadership stops punishing the visible mistake more than the invisible one. Guest view: Dave Chismon, the NCSC's CTO for Architecture, makes the underlying argument, and Brown quotes Halvar Flake's line that all offensive problems are technical while all defensive problems are political.
- **When responsibility is split, nobody owns the step**: Brown treats unclear ownership as a distinct failure mode, not a communications problem. In the offboarding case, HR assumed IT would act once the termination was processed, while IT was waiting for HR to send a formal request. The mechanism is diffusion of responsibility, compared with why a crowd can be slower to help than a single bystander: split the ownership and you do not get double coverage, you get none. The stated fix is blunt and specific, including zero tolerance for one person owning a whole system alone. Guest view: Yad Senapathy, who worked in IT at the company when the incident happened, recounts the gap.
- **Automation scales whatever pressure it is dropped into**: Mark Brown's argument about automation is about direction as much as speed. As a patch backlog grows, testing gets compressed and review gets skimmed because pressure to close the gap overrides the judgement that prevents harm. Adding automation to that environment does not relieve the pressure; it multiplies it. Through BJ Fogg's model, motivation and apparent ability are both high, so the behaviour fires repeatedly and faster. The prompt decides what happens: if it says deploy, the behaviour is deployment; if no prompt says stop, the system never stops. The technical case comes from Gene Moody, Field CTO at Action1, writing in security press; Brown adds the behavioural layer. The same pattern appears in the AI-defence post, where the institutional argument comes from the NCSC. Ask for the source material if you need to assess the technical analysis independently.
- **Every argument ends in one cheap control and a question to the reader**: The posts move quickly from diagnosis to a single, cheap, adoptable change, then hand the same question back to readers so they can audit their own setup. The value offered is a decision someone can make this week, not a framework to admire. Closing questions focus on what has already been assumed rather than what has been documented.

## Work to read

- [The breach where nobody broke in — they just asked](https://www.linkedin.com/posts/markbrownpsybersafe_cybersecurity-behaviouralscience-activity-7508498301135290368-G2tf)
- [Two departments, one job, nobody did it: the offboarding failure](https://www.linkedin.com/posts/markbrownpsybersafe_cybersecurity-behaviouralscience-offboarding-activity-7505883321042690048-JrSl)
- [A malware campaign with no malicious-looking parts](https://www.linkedin.com/posts/markbrownpsybersafe_cybersecurity-behaviouralscience-humanrisk-activity-7513493459404607488-llqh)
- [Why defenders hesitate while attackers don't](https://www.linkedin.com/posts/markbrownpsybersafe_behaviouralscience-cybersecurity-ai-activity-7510956731519180800-CCbf)
- [Automation needs brakes, not just an accelerator](https://www.linkedin.com/posts/markbrownpsybersafe_behaviouralscience-patchmanagement-cybersecurity-activity-7508420067076907008-9ZIm)

## Brand relationships

- **Psybersafe Insights** (mention)

## Partnerships

None of the five posts describes a sponsorship programme. There is no published rate card, media kit, audience demographic breakdown, sponsored-format specification or partnership contact address. Mark Brown’s only stated contact route is a LinkedIn direct message, offered in a post for a specific conversation with security leaders whose teams stall after a fix backfires (“DM me if you'd like to talk that through”). That is an offer to discuss an operational problem, not a commercial booking route. Two possible vehicles are visible but undocumented. The posts refer to Psybersafe Insights, a monthly publication looking at why people comply with fraudulent requests, and one post was written from BE-Cyber, the Belgian Cyber Security Coalition's event in Wavre. Ask whether Psybersafe Insights carries sponsor content or co-branded research, and whether they appear at commercial events. Before budgeting, confirm the available format, price, lead time and audience demographics with them on LinkedIn. If the campaign focuses on cybersecurity training, ask whether they would take on a co-produced article or webinar on behavioural analysis of real breaches.

## Alternatives

- Makarand Karanjalkar: Choose Makarand Karanjalkar when the same human-risk campaign needs to reach detection, threat-intelligence or security-operations readers rather than an HR or compliance audience. The two posts explain what the OCA Indicators of Behaviour subproject aims to do on top of STIX 2.1, and why behaviour analytics in Defender, Falcon, Splunk, Exabeam, Darktrace and Chronicle answer “is this unusual?” rather than “what is the attacker trying to achieve?” That gives a training vendor a course or webinar tied to tooling categories SOC teams already buy against, alongside a vendor-neutral standards story rather than an incident story. Karanjalkar is the better pick when credibility with a technical security audience and interoperability language matter more than a relatable workplace scenario.
- Ido Geffen: Choose Ido Geffen when the campaign is product-led, targets security leaders with budget authority, and offers automation or AI-driven testing rather than training. The two posts turn news into a commercial argument: New York Times reporting on CISO pay and hiring demand, viewed through a “bug-pocalypse” in which AI writes code and finds flaws faster than human review can keep up; and OpenAI’s Black Hat talk, where internal agents reportedly shared a memory system, built on each other’s findings and chained exploits. Both lead with the capability gap, then position Novee Security’s continuous pentesting agents as the answer. Choose Geffen when a vendor wants a named spokesperson to argue for its category over human-only staffing, using current AI-offence news as the hook.
- John Ellingson: Choose John Ellingson when the deliverable is an executive- or board-level thesis rather than a training module. The two posts are data-heavy, long-form arguments. One reads the CrowdStrike 2026 Global Threat Report, the WEF 2026 outlook and the Verizon DBIR together, then extrapolates ten years of scale, speed and scope; the post says the extrapolation is the author’s own, not a finding of those reports. The other argues that the industry has spent 40 years treating cybersecurity as a technology problem, while 68-82% of breaches involve a human element, and proposes structurally removing humans from the attack surface. The numbers, named sources and clear position give a training company material for a keynote or debate-led piece.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/