# Steve S.

Steve S. makes short videos about cybersecurity, with a focus on security culture, human risk, leadership, and real-world security failures in healthcare.

- Profile: https://b2binfluencer.marketing/creators/steve-s/
- LinkedIn: https://www.linkedin.com/in/stevespearman1
- LinkedIn followers: 3,284
- Topics: leadership, cybersecurity, healthcare
- Based on 11 dated posts, latest 2026-10-07

## Summary

Most useful for short videos on security culture, human risk, leadership, and healthcare security failures.

- Best for: A cybersecurity awareness training company seeking a short-video series on security culture and human risk.
- Not for: An endpoint or platform security vendor seeking technical product demos for security engineers.
- Check first: Confirm terms, pricing, lead time, and audience performance data first.

### Takeaways

- Four culture types are apathy, anxiety, comfort, and resilience.
- Change Healthcare breach is told as a chain of small failures.
- They promise a free S.A.F.E.R. tool for responding under pressure.

## Main ideas

- **Security culture comes down to trust and accountability**: Steve S. argues that “culture” in cybersecurity stays vague until it is split into two variables: how much trust people feel and how much accountability leaders expect. Combining them produces four zones — apathy (low trust, low accountability), anxiety (low trust, high accountability), comfort (high trust, low accountability), and resilience (high trust, high accountability). Both ingredients are needed: trust gets problems reported, and accountability gets them fixed. Without trust, people hide mistakes; without accountability, disclosed problems go nowhere.
- **Employees are an under-supported line of defense, not the weak link**: In their framing, “people are the weakest link” is a lazy excuse. Steve S. argues that employees are sometimes the only defense against scams, social engineering, and real-world threats no tool catches. Organizations set them up to fail with outdated training, little context, and no support, then blame them when something goes wrong. The priority is support before an incident, not a warning after one.
- **Culture problems are leadership problems**: Steve S. treats silence, fear, and disengagement among staff as outcomes of leadership, not bad luck. Their argument is that culture is not repaired with posters or pep talks but by changing how leaders behave: some habits quietly destroy trust, while others rebuild it. Whether people feel safe enough to raise problems depends on what leaders do, not what they say.
- **Real security failures start with ordinary missed steps**: Their case studies trace large incidents to mundane control or process failures rather than exotic attacks. They frame these events as cultural and governance problems, making them useful teaching material: organizations can inspect and change the underlying controls and processes.
- **An idea should end in something the audience can use**: Steve S. regularly closes an argument with a takeaway: a named framework, a set of habits, a free tool, or a preview of the next episode. They deliver these as short, single-idea videos, sometimes serialized so that one sets up the next, giving viewers something to apply rather than just agree with.

## Work to read

- [Four culture types defined by trust and accountability](https://www.linkedin.com/posts/stevespearman1_cybersecurity-leadership-trust-activity-7350518072773943297-G7I6)
- [“People are the weakest link” as a lazy excuse, with a promised S.A.F.E.R. tool](https://www.linkedin.com/posts/stevespearman1_cybersecurity-securityculture-humanrisk-activity-7350879921319092224-NKWR)
- [Change Healthcare breach told as a chain of small failures](https://www.linkedin.com/posts/stevespearman1_cybersecurity-changehealthcare-ransomware-activity-7354142114873516033-4jbh)
- [A hospital offboarding failure framed as a cultural flaw](https://www.linkedin.com/posts/stevespearman1_cybersecurity-hipaa-offboarding-activity-7353447286422577152-yT30)
- [“Fixing a Broken Culture” ties culture problems to leadership behavior](https://www.linkedin.com/posts/stevespearman1_leadership-culture-accountability-activity-7353778878647005184-1H94)

## Partnerships

Steve S.’s five LinkedIn posts do not mention a published partnership program: no media kit, rate card, sponsorship policy, or inquiry route. The format is clear: short explanatory videos, mostly around three minutes, that tell a specific security story and draw a lesson about culture, human risk, or governance. For a cybersecurity awareness training company, that format could suit a sponsored video series. Ask about terms, pricing, and lead time directly.

## Alternatives

- John C.: Consider John C. when a series needs to land with a board or C-suite audience rather than frontline staff. The posts are written from the perspective of both a healthcare CIO and a board director. One argues that sitting on a board taught more about leading a business than the CIO role or an MBA, and frames governance as the means to ask whether strategy is clear, investments are prioritised well, risk is managed, the business is financially viable and the right leaders are being developed. The other argues that current cyber security knowledge is table-stakes for a healthcare CIO and lists what that covers: medical device and IoMT risk, identity and access management, Zero Trust, ransomware resilience, third-party and supply-chain risk, incident response, AI-enabled threats and clinical downtime. A training company selling governance-level cyber risk understanding, or a sponsor whose buyer is a CIO or board member, gets a closer match on audience and vocabulary than a staff-facing culture series would offer.
- Mark Brown: Consider Mark Brown when a human-risk campaign needs behavioural-science grounding rather than a culture framework. The posts take a named argument or a live campaign and explain the psychology behind it. One unpacks the NCSC’s point that attackers can automate freely while defenders hesitate because a fix that breaks something is blamed on the person who made it. It ties that to omission bias using the 1990 Ritov and Baron vaccination study. The other dissects a fake software campaign aimed at HR staff through BJ Fogg’s behaviour model—motivation, ability and prompt stacked together so no single suspicious signal appears—and ends with one process change that would break the chain. For an awareness-training client seeking episodes that cite research, walk through a real attack step by step and end with a concrete fix, this is a closer fit than a four-zone culture model. Mark Brown also closes that post with a direct invitation to talk privately, offering a visible contact route.
- Derek Boxdell: Consider Derek Boxdell when a campaign shifts from office security culture to industrial or operational technology. The posts are built for manufacturing and OT audiences: downtime as an existential risk, with security reframed as production assurance; AI shortening attacker breakout time; and dark factories raising system-dependence risk. Each is paired with a directive, such as prioritising OT resilience the way uptime is prioritised or designing security into automation rather than bolting it on. The other post is a monthly field-notes roundup covering human distraction as the biggest security gap, trust as the new battleground after named telecom breaches, and compliance becoming a competitive edge as new rules reshape expectations. A sponsor targeting plant, OT or manufacturing leaders, or wanting a speaking-and-roundup format instead of a produced mini-series, is a closer fit here than with a general staff-awareness series.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/