Mark Brown

The HR malware campaign is framed as a failure of environmental design rather than vigilance: behaviour was triggered before any suspicious signal appeared.

• The offboarding incident is a process problem, not a technical one: revoking a login takes seconds, and the real gap was a job nobody owned.
• Patch automation is a system with no moment designed for checking.
• The priority is always the same: redesign the prompt, approval step or verification habit, and stop treating awareness as the fix.

In the HR and payroll malware campaign, the fake sites were built with a legitimate AI app builder, the downloads sat on GitHub, the installer showed a genuine Microsoft window, and the payload was ConnectWise ScreenConnect, a real remote management tool working as designed for someone who should never have had it.

• The only tell was that none of the impersonated vendors actually sold a desktop client.
• Mark Brown proposes a standing instruction to verify a vendor's product range before downloading anything.

Read original · Original 2 · Original 3

BJ Fogg's behaviour model, where motivation, ability and a prompt have to converge, is the main tool, used for both the HR malware campaign and patch automation.

• Omission bias, drawn from a 1990 study by psychologists Ilana Ritov and Jonathan Baron, explains why defenders hesitate to act.
• Diffusion of responsibility explains the offboarding gap.
• The predictable structure helps readers see how they reason, not just what they conclude.

The Ritov and Baron study involved parents reluctant to vaccinate a child when the vaccine itself could kill, even when that risk was far smaller than the disease's.

• Mark Brown uses it to argue that harm we cause by acting feels heavier than greater harm we allow by doing nothing.
• That is why leaving a vulnerability unpatched feels like bad luck, while breaking a system during a fix feels like somebody's fault.

Read original · Original 2 · Original 3 · Original 4

An attacker's automated agent has a clear finish line: the exploit either works or it does not.

• A defender's agent has to weigh whether a patch will take down the VPN, whether a firewall rule will break something finance depends on, and who answers for it if it does.
• Brown highlights the board's perspective: some members see little difference between an attacker taking IT down and the security team doing it by accident, except that the board cannot shout at an attacker over the phone.
• The conclusion is that automating low-risk defensive actions only works if leadership stops punishing the visible mistake more than the invisible one.
• Guest view: Dave Chismon, the NCSC's CTO for Architecture, makes the underlying argument, and Brown quotes Halvar Flake's line that all offensive problems are technical while all defensive problems are political.

Score each automated defensive action by what it can change and how easily it can be undone, then automate the low-risk ones first. Do not treat all defensive automation as equally safe.

Read original

In the offboarding case, HR assumed IT would act once the termination was processed, while IT was waiting for HR to send a formal request.

• The mechanism is diffusion of responsibility, compared with why a crowd can be slower to help than a single bystander: split the ownership and you do not get double coverage, you get none.
• The stated fix is blunt and specific, including zero tolerance for one person owning a whole system alone.
• Guest view: Yad Senapathy, who worked in IT at the company when the incident happened, recounts the gap.

A terminated employee at a company of more than a thousand people kept working for days after being fired, deleting files, locking colleagues out of their accounts and corrupting a database.

• The incident cost hundreds of thousands of dollars and weeks of project time.
• Proposed controls include same-day deletion of access, forced review of shared credentials, and ensuring no single person owns an entire system alone.

Read original

As a patch backlog grows, testing gets compressed and review gets skimmed because pressure to close the gap overrides the judgement that prevents harm.

• Adding automation to that environment does not relieve the pressure; it multiplies it.
• Through BJ Fogg's model, motivation and apparent ability are both high, so the behaviour fires repeatedly and faster.
• The prompt decides what happens: if it says deploy, the behaviour is deployment; if no prompt says stop, the system never stops.
• The technical case comes from Gene Moody, Field CTO at Action1, writing in security press; Brown adds the behavioural layer.
• The same pattern appears in the AI-defence post, where the institutional argument comes from the NCSC.
• Ask for the source material if you need to assess the technical analysis independently.

Mark Brown reads the staged rollout rings, predefined success criteria and automated halt conditions described by Gene Moody as behavioural design, not merely technical features. They build a decision gate into the process so human judgement is not left to erode under fatigue and speed pressure.

Read original · Original 2

The value offered is a decision someone can make this week, not a framework to admire. Closing questions focus on what has already been assumed rather than what has been documented.

The Revolut breach post proposes one control: call back using a phone number the team already held rather than trusting the contact details in the request.

• It points readers to that month's Psybersafe Insights piece for more on why capable people say yes.
• The offboarding post asks where a business has quietly assumed someone else owns a step that nobody owns; the automation post asks where a security process has automated the accelerator and forgotten the brakes.

Read original · Original 2 · Original 3 · Original 4

Start here for the argument before the theory.

Written after the Belgian Cyber Security Coalition's BE-Cyber event in Wavre, this post rejects the description of the Revolut breach as a sophisticated attack.

• A data request arrived from an address belonging to a real government body.
• The compliance team handled it like any other request, and customers' passport details went out the door.
• Nothing was hacked; a process built to say yes said yes.
• The safeguard is to call a phone number the team already held, rather than trust the contact details in the request.
• The post points readers to that month's Psybersafe Insights newsletter for more on why capable people comply.

For brands planning a campaign

A ready-made spine for an article or webinar on authority-based social engineering. The angle is not gullibility but a missing verification step: run the request live as a scenario, then have the audience design the callback rule and decide who owns it.

A terminated employee at a company of more than a thousand people kept working for days after being fired, deleting files, locking colleagues out of their accounts and corrupting a database.

• The company lost hundreds of thousands of dollars and weeks of project time.
• Yad Senapathy, then working in IT there, explains the gap: HR assumed IT would act once the termination was processed, while IT waited for HR to send a formal request.
• Mark Brown names the mechanism, diffusion of responsibility, and compares it to why a crowd can be slower to help than a single bystander: split the ownership and you get none of the coverage.
• The proposed fix is same-day access deletion, a forced review of shared credentials and no single person owning a whole system alone.
• The post asks where a business has quietly assumed someone else owns a step that nobody owns.

For brands planning a campaign

Strong material for joint HR-and-IT training: the failure sits between the two functions, not inside either. A campaign could ask teams to name one accountable owner for each offboarding step and publish the resulting checklist.

Good for readers who want a concrete human-risk example rather than a definition.

Drawing on reporting from The Register, the post describes HR staff being handed remote-access software — tools that let an outsider control a machine — disguised as desktop upgrades for HR and payroll systems.

• The fake sites were built with a legitimate AI app builder, the downloads were hosted on GitHub, and the installer showed a genuine Microsoft window.
• The tool dropped silently in the background was ConnectWise ScreenConnect, a legitimate remote management product doing what it was designed to do for someone who should never have had it.
• The only tell: none of the impersonated vendors actually offer a desktop client.
• Mark Brown reads the campaign through BJ Fogg's behaviour model, in which motivation, ability and a prompt converge, and argues that the behaviour was triggered before any suspicious signal appeared.
• The proposed process change is a standing instruction to verify a vendor's product range directly before downloading anything.

For brands planning a campaign

Points to a specific, teachable rule rather than generic vigilance messaging: confirm the vendor actually sells the product. A phishing-awareness vendor could build a short module around verifying product offerings and use the Fogg framing to explain why the polished download page worked.

Read this to understand the reasoning behind the other examples.

Mark Brown responds to an NCSC blog by Dave Chismon, its CTO for Architecture, on why defenders cannot use agentic AI the way attackers can.

• Chismon opens with Halvar Flake's line that all offensive problems are technical and all defensive problems political.
• An attacker's agent has a finish line — the exploit works or it does not — while a defender's agent has to ask whether a patch will take down the VPN, whether a firewall rule will break something finance relies on, and who answers for it if it does.
• The sharpest point is the board's view: some board members see little difference between an attacker taking IT down and the security team doing it by accident, except that the board cannot shout at an attacker over the phone.
• The post explains the hesitation through omission bias, citing a 1990 study by Ilana Ritov and Jonathan Baron in which people were reluctant to vaccinate a child when the vaccine itself could kill, even when that risk was far smaller than the disease's.
• The NCSC's suggested remedy is to score each automated defensive action by what it can change and how easily it can be undone, then automate low-risk actions first.
• That only works, the post argues, if leadership stops punishing visible mistakes more than invisible ones.

For brands planning a campaign

A thought-leadership angle on why security teams move slowly: the constraint is accountability design, not tooling. A webinar could pair the omission-bias explanation with a practical risk-scoring worksheet for automated defensive actions, aimed at security leaders and their boards.

Best for readers interested in the operational side of human risk.

Reacting to a BleepingComputer piece by Gene Moody, Field CTO at Action1, Mark Brown argues that patch automation needs brakes, not just an accelerator.

• As a backlog grows, testing gets compressed, review gets skimmed and pressure to close the gap overrides the judgement that prevents harm.
• Automation in that environment does not relieve the pressure; it scales it.
• Through BJ Fogg's behaviour model, motivation is high and ability looks high, so the behaviour fires repeatedly and faster.
• The prompt matters most: if the prompt is deploy, the behaviour is deployment; if no prompt says stop, the system never stops.
• The brakes Moody describes — staged rings, predefined success criteria and automated halt conditions — are treated as behavioural design rather than technical features.
• They encode a decision gate into the process so fatigue and speed do not erode judgement.
• The post asks where a security process has automated the accelerator and forgotten the brakes.

For brands planning a campaign

A concrete hook for content aimed at security operations and change-management audiences: automation governance as behavioural design. A vendor could run a session on writing halt conditions and success criteria before a deployment window, not after.

An NCSC blog on why defenders cannot use agentic AI the way attackers do is viewed through omission bias and the 1990 Ritov and Baron vaccination study, in which people avoid acting when the action itself could cause harm.

• An HR-targeted malware campaign is explained through BJ Fogg's behaviour model, in which motivation, ability and a prompt line up before any suspicious signal appears.
• The same model is applied to patch automation, while a terminated employee who kept working for days is explained through diffusion of responsibility.

The recurring format is a specific incident, a named study or model, one process change that could have broken the chain, and a direct question to the reader. Posts are short, plain-spoken and tagged #behaviouralscience and #cybersecurity, plus one topic tag.

For brands planning a campaign

This is the strongest match for a thought-leadership brief.

• A cybersecurity training vendor can supply the incident or customer story, while Mark Brown provides the behavioural mechanism and a single process fix—the formula behind these posts.
• A webinar built around one breach and one behavioural principle would follow the existing pattern rather than ask for a new one.

Examples: Source 1 · Source 2 · Source 3 · Source 4

The HR malware campaign is framed as a failure of environmental design, not vigilance; the fix is a standing instruction to verify a vendor's product line before downloading anything.

• The offboarding failure is presented as a process with no named owner, rather than a technical problem.
• Patch automation is described as a system with no moment designed for checking.

For brands planning a campaign

Training content that leads with 'be more careful' would sit awkwardly alongside this work. Content that redesigns the prompt, approval step or verification habit fits better and gives the vendor a defensible editorial position rather than another awareness message.

Examples: Source 1 · Source 2 · Source 3

The offboarding case quotes a former IT staffer explaining that HR assumed IT would act while IT waited for HR; Brown identifies this as diffusion of responsibility.

• The AI-defence post cites the NCSC's point that boards can shout at an attacker but not at their own security team.
• Its operational fix is zero tolerance for one person owning a whole system alone.

The posts draw on first-hand testimony from others and institutional sources, then apply a named social-psychology finding to explain the gap.

For brands planning a campaign

This gives a training vendor material for executive and governance audiences, where the buying problem is unclear accountability for a step nobody owns, not staff awareness. The offboarding story is concrete enough to open a session or article without further research.

Examples: Source 1 · Source 2

A vendor field CTO's proposed staged rollout rings, predefined success criteria and automated halt conditions are treated as behavioural design, not just technical features. The AI-defence post makes a parallel argument: an attacker's agent has a clear finish line, while a defender's agent must weigh whether a fix will break something else and who will be blamed if it does.

The automation posts take their technical arguments from others—a vendor field CTO and an NCSC architect—and add the behavioural layer rather than originating the security analysis.

For brands planning a campaign

This is a useful angle for a webinar or article aimed at security leaders adopting automation: where is the stop decision encoded, and where is human judgement left to erode? Ask for a technical interviewee or client voice, since the posts rely on borrowed technical authority.

Examples: Source 1 · Source 2

The Revolut breach is described as unsophisticated: a data request arrived from a real government address, compliance treated it as routine, and passport details left the building.

• The proposed control is a callback to a number already held.
• The HR campaign used a legitimate AI site builder, GitHub hosting, a genuine Microsoft installer window and a legitimate remote management tool.
• The only tell was that the impersonated vendors do not offer desktop clients.

For brands planning a campaign

These are ready-made case studies for a social-engineering or human-risk module, each ending with one cheap control the audience can adopt. Both could serve as article sections or worked examples in a live session.

Examples: Source 1 · Source 2

Sources across the posts include security press (The Register, BleepingComputer), a national body (the NCSC), vendor field CTOs and named psychology studies. One post reports from BE-Cyber in Wavre, described as the Belgian Cyber Security Coalition's flagship event, and points readers to a monthly 'Psybersafe Insights' piece on why people comply with fraudulent requests.

The conference post combines event coverage with a pointer to the longer monthly item.

For brands planning a campaign

Short, source-anchored posts suit an ongoing ambassador or contributor arrangement better than a single large asset. The monthly Insights item also offers a potential outlet for a partner to appear in or co-produce.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

Ask what their relationship with Psybersafe is.

View example

Both push practitioners past the artifact-level view: Brown past "people were careless", Karanjalkar past indicators of compromise and anomaly alerts.

Karanjalkar's behaviour is adversary behaviour formalised for machines — Indicators of Behaviour built on the OASIS STIX 2.1 standard, and the distinction between behaviour analytics that flags something unusual and behavioural threat intelligence that explains what it means.

• His reader is a detection engineer or SOC analyst.
• Mark Brown focuses on human and organisational behaviour; their readers are those who own the process.
• Go to Karanjalkar for the technical vocabulary, Brown for the psychological one.

Read original · Original 2

Geffen frames a capability gap and answers it with a product — AI agents that pentest continuously, and posts that close with a link to Novee Security.

• Brown's answer is a process change and a named owner, with nothing for sale.
• Geffen also works at machine speed and offensive tradecraft, with agents sharing memory and chaining zero-days; Brown stays with the human decision and the blame that follows it.
• Choose Geffen for the offensive AI arms-race argument, Brown for why the person at the keyboard hesitated.

Read original · Original 2

Both start from breach statistics that put a human element in most incidents and conclude that the industry is solving the wrong problem — hardening the walls while leaving people as the route in.

Brown redesigns the prompt and the approval step so people inside the system behave better.

• Ellingson's conclusion is structural removal: no humans in the authentication loop, no standing credentials, an architecture that makes the human attack class impossible.
• Ellingson writes long extrapolations from named reports such as CrowdStrike's global threat report and Verizon's DBIR; Brown writes short posts about a single incident.
• Read Ellingson for the architecture thesis, Brown for the process fix you could adopt this week.

Read original · Original 2

The two posts explain what the OCA Indicators of Behaviour subproject aims to do on top of STIX 2.1, and why behaviour analytics in Defender, Falcon, Splunk, Exabeam, Darktrace and Chronicle answer “is this unusual?” rather than “what is the attacker trying to achieve?”

• That gives a training vendor a course or webinar tied to tooling categories SOC teams already buy against, alongside a vendor-neutral standards story rather than an incident story.
• Karanjalkar is the better pick when credibility with a technical security audience and interoperability language matter more than a relatable workplace scenario.

Mark Brown’s posts lack the behavioural mechanism and practical process fix that make content useful in training.

• Neither names a psychological study or turns an incident into a control an HR or finance team can adopt.
• Both are long technical explainers that end with a question rather than a concrete step.
• Their focus is adversary behaviour, not employee behaviour, so they don’t offer the human-risk angle needed for training.
• The posts cover two dates in July 2026.
• Ask for follower counts, engagement figures and commercial terms before booking.

Examples: Source 1 · Source 2

The two posts turn news into a commercial argument: New York Times reporting on CISO pay and hiring demand, viewed through a “bug-pocalypse” in which AI writes code and finds flaws faster than human review can keep up; and OpenAI’s Black Hat talk, where internal agents reportedly shared a memory system, built on each other’s findings and chained exploits.

• Both lead with the capability gap, then position Novee Security’s continuous pentesting agents as the answer.
• Choose Geffen when a vendor wants a named spokesperson to argue for its category over human-only staffing, using current AI-offence news as the hook.

The posts are openly commercial and tied to one employer’s product.

• The same material would read as product marketing on a training company’s page, and it promotes a category that competes with the training premise rather than supporting it.
• There’s no behavioural-science mechanism, incident-to-process-fix arc or material for HR or finance readers who need to change a workflow after a breach.
• The posts cover two dates, May and August 2026.
• Ask for follower counts, engagement figures and commercial terms before booking.

Examples: Source 1 · Source 2

The two posts are data-heavy, long-form arguments.

• One reads the CrowdStrike 2026 Global Threat Report, the WEF 2026 outlook and the Verizon DBIR together, then extrapolates ten years of scale, speed and scope; the post says the extrapolation is the author’s own, not a finding of those reports.
• The other argues that the industry has spent 40 years treating cybersecurity as a technology problem, while 68-82% of breaches involve a human element, and proposes structurally removing humans from the attack surface.
• The numbers, named sources and clear position give a training company material for a keynote or debate-led piece.

The tradeoff is direct: the second argument says human-centred defences are the wrong layer to invest in and recommends taking people out of the loop.

• That undercuts a training vendor’s offer and points to a specific named system.
• Neither post closes a single incident with one control and one next step, and the dense material needs a summary for non-specialist readers.
• The posts cover two dates, June and July 2026.
• Ask for follower counts, engagement figures and commercial terms before booking.

Examples: Source 1 · Source 2