Steve S. makes short videos about cybersecurity, with a focus on security culture, human risk, leadership, and real-world security failures in healthcare.
Most useful for short videos on security culture, human risk, leadership, and healthcare security failures.
Best for
A cybersecurity awareness training company seeking a short-video series on security culture and human risk.
Not for
An endpoint or platform security vendor seeking technical product demos for security engineers.
Key takeaways
Four culture types are apathy, anxiety, comfort, and resilience.
Change Healthcare breach is told as a chain of small failures.
They promise a free S.A.F.E.R. tool for responding under pressure.
Check first: Confirm terms, pricing, lead time, and audience performance data first.
Main ideas
Security culture comes down to trust and accountability · Employees are an under-supported line of defense, not the weak link · Culture problems are leadership problems
Steve S. makes short cybersecurity videos about security culture, human risk, leadership, and security failures in healthcare.
Their posts challenge the idea that employees are simply a security weakness: people can also be a line of defense when they have useful training, context, and support.
A useful starting point is the four-zone culture framework, which uses trust and accountability to describe how organizations respond when something goes wrong.
Steve S. makes broad security and culture issues concrete through compact frameworks and case-led explanations.
The four-zone model gives readers two questions—how much trust people feel and how much accountability leaders expect—to examine culture beyond slogans.
Their case posts shift attention from dramatic hacking to failures in access, monitoring, and offboarding.
The posts do not include the videos; ask to see them when assessing the content.
Steve S. argues that security culture is something an organization can observe and change, not a slogan.
Read more
Three claims run through the videos they post about: culture comes down to trust and accountability; employees are an under-supported defense rather than the weak point; and the habits that decide whether people speak up belong to leaders. They support those claims with case studies of real healthcare security failures in which a large incident traces back to an ordinary missed step, such as a login without multi-factor authentication or access that was never revoked after someone left.
Security culture comes down to trust and accountability
Steve S. argues that “culture” in cybersecurity stays vague until it is split into two variables: how much trust people feel and how much accountability leaders expect.
Read more
Combining them produces four zones — apathy (low trust, low accountability), anxiety (low trust, high accountability), comfort (high trust, low accountability), and resilience (high trust, high accountability).
Both ingredients are needed: trust gets problems reported, and accountability gets them fixed.
Without trust, people hide mistakes; without accountability, disclosed problems go nowhere.
The four zones are explained in a short video.
Steve S. tests which zone an organization really occupies by looking not at its stated values but at its behaviour when something goes wrong.
They note that almost every executive team places itself in the resilience zone, then ask how the organization actually reacts when a problem surfaces.
Employees are an under-supported line of defense, not the weak link
In their framing, “people are the weakest link” is a lazy excuse.
Read more
Steve S. argues that employees are sometimes the only defense against scams, social engineering, and real-world threats no tool catches.
Organizations set them up to fail with outdated training, little context, and no support, then blame them when something goes wrong.
The priority is support before an incident, not a warning after one.
The video promoting this argument is paired with an announcement: a free tool called S.A.F.E.R. to help users respond under pressure, which will be shared in a follow-up video. Ask for that follow-up to learn what the tool does before building anything around it.
Steve S. treats silence, fear, and disengagement among staff as outcomes of leadership, not bad luck.
Read more
Their argument is that culture is not repaired with posters or pep talks but by changing how leaders behave: some habits quietly destroy trust, while others rebuild it. Whether people feel safe enough to raise problems depends on what leaders do, not what they say.
In the “Fixing a Broken Culture” post, Steve S. states plainly that if people are silent, scared, or checked out, that is leadership.
Real security failures start with ordinary missed steps
Their case studies trace large incidents to mundane control or process failures rather than exotic attacks.
Read more
They frame these events as cultural and governance problems, making them useful teaching material: organizations can inspect and change the underlying controls and processes.
The Change Healthcare video describes a breach that began with one stolen login — no multi-factor authentication, no alerts, and nine days before anyone responded — and cites $1.5 trillion in healthcare transactions processed annually, more than $1 billion in direct financial impact, 190 million records exposed, and 1 in 3 U.S. medical records touched.
A second video covers a hospital offboarding failure in which, in their account, a former employee with no criminal record ended up in a federal case over celebrity records, with no hacking or malware involved.
The posts cite no primary sources; ask for them before relying on the figures or case details.
The two cases pull in different directions: one turns on a missing technical control, multi-factor authentication; the other on a missing administrative process, revoking access after someone leaves. Their through-line is that both are culture and governance failures, not evidence of a sophisticated attacker.
An idea should end in something the audience can use
Steve S. regularly closes an argument with a takeaway: a named framework, a set of habits, a free tool, or a preview of the next episode.
Read more
They deliver these as short, single-idea videos, sometimes serialized so that one sets up the next, giving viewers something to apply rather than just agree with.
The human-risk video is followed by a promised free tool, the leadership video promises a list of habits that destroy trust, and the culture video offers a four-zone model viewers can use to place their own organization.
This is the clearest statement of the framework Steve returns to: security culture defined by two variables rather than a vague aspiration.
Read more
Newcomers looking to understand how they think about culture should start here.
The post lays out four culture zones built around two questions: how much trust people feel and how much accountability leaders expect.
Low trust and low accountability produce an Apathy Zone; low trust with high accountability, an Anxiety Zone; high trust with low accountability, a Comfort Zone; and high trust with high accountability, what Steve calls the Resilience Zone.
The post’s main point is that every executive team believes it already sits in the Resilience Zone; the real test is how the organization behaves when something goes wrong.
Trust lets problems surface, while accountability gets them fixed.
The post promotes a three-minute video explaining the model.
For brands planning a campaign
A cybersecurity awareness training company could build a series around the four zones, using each as a short episode and pairing the framework with a self-check that lets viewers place their own organization. The trust-and-accountability framing also offers a natural pre/post structure for measuring whether the series shifts how a team describes its culture.
This post lays out Steve’s position on human risk, the central topic for a campaign on the subject.
Read more
It shows the argument running through many of the other posts: organizations overlook people as a line of defense and treat them as the failure.
The post calls “people are the weakest link” a lazy excuse, then argues the opposite: people are sometimes the only line of defense against scams, social engineering, and threats no tool catches.
The criticism targets how organizations support employees, not the employees themselves: outdated training, little context, and no backup, followed by blame when something goes wrong.
The post promotes a three-minute video and says a free tool called S.A.F.E.R. will be shared in a follow-up video to help users respond under pressure.
The tool is not described here; the post gives only its name and intended purpose.
For brands planning a campaign
This post makes the strongest case for a series on security culture and human risk.
It sets up an argument a training company can extend across multiple episodes: what support looks like, what context looks like, and how people respond under pressure.
The S.A.F.E.R. tool is not explained in the posts.
Anyone building a plan around it should ask for the follow-up video or another primary source explaining what the tool does and how it works.
This shows how Steve turns a major industry event into a short narrative a general audience can follow.
Read more
It is the clearest example of the case-study format found across the posts.
The post describes the Change Healthcare breach as a sequence that began with one stolen login: no multi-factor authentication, no alerts, and nine days in which attackers moved undetected.
It states that the company processed $1.5 trillion in healthcare transactions annually, that direct financial impact exceeded $1 billion, that 190 million records were exposed, and that 1 in 3 U.S. medical records was touched.
It calls the result the most disruptive cyberattack in U.S. healthcare history.
The figures are presented as stated in the post, not independently verified here.
For brands planning a campaign
A training company could use this as the anchor episode in a series of real-world case studies, then unpack the controls that were absent and what smaller organizations should do differently. Before reusing the numbers, ask for a primary source; the post does not cite one.
This post clearly illustrates the recurring case-study format, with Steve focusing on governance and process failure rather than hacking.
Read more
It gives readers a second example of the pattern.
The post tells the story of a hospital employee who, according to the post, had no criminal record or history of violence.
It describes them as smart and rebuilding a life in the U.S.; they ended up in a federal case after accessing celebrity records.
The post attributes the incident to an offboarding failure rather than hacking or malware, and says the fallout exposed a cultural flaw that still affects healthcare security.
The post summarizes the case; the underlying video is not included here.
For brands planning a campaign
This supports an episode on access revocation and offboarding, a process topic a training company can turn into a practical checklist.
It also shows that the case-study format does not require a technical breach, making it useful for reaching non-technical decision makers.
Before reusing the case details, ask for a primary source; the post is a summary.
This explains what Steve says leaders should change, connecting the culture-types framework to a direct claim about leadership behavior.
Read more
The post argues that when people are silent, scared, or checked out, that is a leadership problem, not bad luck.
Culture changes not through posters or pep talks but through how leaders lead.
It promotes a short video that calls out habits that quietly destroy trust and describes what rebuilding it requires.
The post does not name the habits; they are covered in the video.
For brands planning a campaign
A training company could pair this post with the four-zone culture video to build a leadership-facing module: first, where the organization sits today; then, which specific leadership behaviors could move it. The named habits appear only in the video, so ask for that video or another primary source before developing content around them.
Healthcare security failures told as case studies2
Security culture as trust plus accountability1
People are not the weakest link1
Culture is set by leadership behaviour1
Security culture as trust plus accountability
Steve S. defines security culture through two variables: how much trust people feel and how much accountability leaders expect.
Read more
Those produce four zones — apathy (low trust, low accountability), anxiety (low trust, high accountability), comfort (high trust, low accountability), and resilience (high trust, high accountability).
The claim is that almost every executive team believes it sits in the resilience zone, and that the real test is how the organization reacts when something goes wrong.
Good culture, in this framing, needs trust so problems surface and accountability so they get fixed.
A three-minute video that reduces culture to a two-axis model, then adds a single diagnostic question: What happens when something goes wrong?
For brands planning a campaign
A security-awareness training company can build a series episode around the trust/accountability grid, using the question “How do you react when something goes wrong?” as an on-camera prompt or workshop exercise. The model gives a short video a reusable visual frame rather than a one-off message.
Steve S. pushes back on the phrase “people are the weakest link,” calling it a lazy excuse.
Read more
They argue that people are sometimes the only line of defense against scams, social engineering, and real-world threats no tool catches, and that organizations give them outdated training, little context, and no support before blaming them when things go wrong. The post reframes the audience as an overlooked solution rather than the problem and announces a follow-up: a free tool called S.A.F.E.R. to help users respond under pressure.
A contrarian hook aimed at a familiar industry slogan, followed by a promised free tool — a two-post arc that turns an argument into a takeaway the audience can use.
For brands planning a campaign
A training client can position a series around supporting employees rather than blaming them, with the S.A.F.E.R. tool as the concrete deliverable that keeps viewers returning for the next video. It also gives a human-risk module a clear angle and a usable job aid.
If people are silent, scared, or checked out, Steve S. treats that as a leadership outcome rather than bad luck.
Read more
The post argues that culture is not fixed with posters or pep talks but by changing how leaders lead.
It names the habits that quietly destroy trust and what it takes to rebuild it.
This is the leadership-facing counterpart to the trust/accountability model: the same concern with whether people feel safe enough to speak up.
A short video that assigns the problem to leaders and promises a concrete list of trust-destroying habits, rather than abstract culture messaging.
For brands planning a campaign
Useful for the leadership or manager tier of a training program, where the buyer's audience is executives rather than general staff. A campaign can pair this with the trust/accountability framework to cover both the model and the behaviours that produce it.
One covers the Change Healthcare breach: the scale of transactions and financial impact, 190 million records exposed, one stolen login, no MFA, no alerts, and nine days before anyone responded.
Another covers an offboarding failure in a hospital, described as a smart person with no criminal record who ended up in a federal case for looking at celebrities' records — no hacking and no malware, just access that was never properly revoked.
Both stories are framed as cultural and governance problems, not exotic technical attacks.
Narrative case studies: lead with stakes or scale, locate the failure in one ordinary human or process cause, and close by explaining why it still matters.
For brands planning a campaign
Strong fit for healthcare and compliance audiences.
Breach post-mortems and offboarding/access-revocation stories can anchor a series and give training modules specific, memorable incidents instead of generic warnings.
A client could co-produce episodes around incidents relevant to its own vertical.
Across the available posts, the format is consistent: short videos, described as roughly three minutes where a length is given, each built on one idea, an attention-grabbing opening, a stated takeaway, and hashtags for discovery.
Read more
The subject matter spans security culture, human risk, leadership, and healthcare-specific incidents.
Some posts preview the next video, as with the S.A.F.E.R. tool.
The published text shows the framing and hooks.
The available material consists of five short post captions. Ask for video transcripts or full videos to assess the on-camera treatment and depth of each video.
For brands planning a campaign
A brief should be built around a recurring short-video series with a fixed structure rather than long-form content. The teaser-then-deliver pattern supports a multi-episode campaign where each video sets up the next, which suits a training company building sustained awareness programming.
Steve S.’s posts do not mention any brand partnership, sponsorship, client work, or business ownership.
Read more
All five promote their own short videos on security culture, human risk, and healthcare security failures, linking back to that video content rather than to a third-party brand.
The Change Healthcare breach is the subject of a case-study video, not evidence of a working relationship with the company.
The mention of HIPAA refers to a healthcare privacy law, not a commercial partner.
They also refer to their own free security-awareness tool, S.A.F.E.R.; no company behind it is named.
Ask Steve S. to disclose any relationships not shown in these posts.
Steve S. publishes short videos about security culture, human risk, and healthcare security incidents.
Read more
Start with the trust-and-accountability model for culture, then the argument that employees are an under-supported defense rather than the weak link, followed by the leadership behaviours that determine whether people speak up.
Case-study videos on the Change Healthcare breach and a hospital offboarding failure show how those ideas play out in real incidents.
Several posts lead into a next episode, a named framework, or a free tool; follow the series in order to explore those connections.
Both treat cybersecurity as a leadership and governance concern and write for healthcare technology executives.
Read more
John C. reflects on board service and argues that healthcare CIOs need current cyber-risk knowledge across IoMT, zero trust, ransomware resilience, and patient safety.
John C.'s posts are executive reflections and professional-development checklists; Steve S. builds short culture frameworks and narrated incident videos about human behaviour and security culture.
Mark Brown applies behavioural science to real attack chains and defensive decision-making, including omission bias and motivation-ability-prompt analysis.
Mark Brown's posts are analytical essays grounded in named research and specific campaign mechanics; Steve S. packages the same broad subject as short videos with simple models and case studies.
Both translate cybersecurity trends into executive takeaways through short, practical posts or videos.
Read more
Derek Boxdell focuses on manufacturing and OT/industrial security, AI in operations, and field-note summaries; Steve S. focuses on healthcare incidents, security culture, and human risk.
The only published audience figure is 3,284 LinkedIn followers, recorded 9 October 2026.
Read more
No impressions, views, likes, comments, watch data, or audience demographics are published for the five posts, so they do not show who watches or engages.
The posts target people who own security awareness inside an organisation.
Four frame short videos on human risk, security culture, leadership accountability, and specific healthcare security failures (a hospital offboarding case and the Change Healthcare breach).
One introduces S.A.F.E.R., a free tool for helping users respond under pressure.
The language covers culture types, trust versus accountability, weak-link framing, HIPAA, and offboarding failure.
The five-post sample is too small to establish a reliable trend in topic, format, or video length; the posts run 14–24 July 2025.
For a security-culture and human-risk video series, request recent results for comparable topics, formats, and depth before committing: impressions, views, completion, and comments from identifiable security or IT roles; whether the videos run on LinkedIn, YouTube, or another platform; and any audience survey or platform analytics covering job function, occupation, and seniority.
A YouTube demographics report would cover geography, age, and gender, but not verify that viewers are security leaders or training buyers.
Ask whether audience survey results or another documented source can verify those professional attributes.
LinkedIn followers
3,284
Steve S.'s LinkedIn profile (linkedin.com/in/stevespearman1) · 2026-10-09
Steve S.’s five LinkedIn posts do not mention a published partnership program: no media kit, rate card, sponsorship policy, or inquiry route.
Read more
The format is clear: short explanatory videos, mostly around three minutes, that tell a specific security story and draw a lesson about culture, human risk, or governance.
For a cybersecurity awareness training company, that format could suit a sponsored video series.
Good fit: a cybersecurity awareness training company seeking a short-video series on security culture and human risk for security, compliance, and people-risk leads.
Read more
The posts take a clear, repeatable position on the subject.
They define culture through trust and accountability, describe four zones — apathy, anxiety, comfort, resilience — and make the real test how an organisation acts when something goes wrong.
They reject the lazy “people are the weakest link” framing, treating employees as an overlooked defence that needs better support, context, and training.
They also promise a free S.A.F.E.R. tool for responding under pressure.
Culture problems, they argue, stem from leadership behaviour, not posters or pep talks.
Real incidents — the Change Healthcare breach and a hospital offboarding failure — illustrate governance and process failures rather than exotic hacking.
The format is consistent: short, single-idea videos, mostly around three minutes, built around a hook, a lesson, and sometimes a next-episode tease.
Agree terms, pricing, and lead time directly: no sponsorship programme, rate card, or inquiry route appears in the posts.
The only audience figure is 3,284 LinkedIn followers recorded 9 October 2026; there are no impressions, views, completion, comments, or job-function data.
Request audience and performance data before setting reach or buyer-composition expectations.
The S.A.F.E.R. tool is named and described by purpose, while the leadership habits are promised in a video not included here; confirm both from primary sources before building an episode around them.
When to choose a specialist
Poor fit as scoped: an endpoint or platform security vendor seeking a technical product-demonstration series — architecture walkthroughs, MFA implementation details, benchmark comparisons, or product UI demos — for security engineers, measured by demo requests or pipeline.
Read more
The posts do not show product evaluation, technical tutorials, code or architecture explanations, or vendor comparisons.
They focus on culture, leadership, human risk, and case-study storytelling about governance and process failure.
The only audience figure is 3,284 LinkedIn followers recorded 9 October 2026; there are no impressions, views, completion, comments, or job-function data.
Request audience and conversion data before making a product-led engineering series the brief; the material shown supports a culture or human-risk series instead.
A worked campaign example
Worked campaign angle: “Culture Under Pressure” — a sponsored short-video series for a cybersecurity awareness training company.
Five episodes, each roughly three minutes and built around one idea: (1) the four culture zones and the question “what happens when something goes wrong?”; (2) why “people are the weakest link” is a lazy excuse, and what support looks like; (3) how leaders create silence or safety; (4) the Change Healthcare breach as a chain of small failures; (5) the hospital offboarding case as a governance failure.
Each episode opens with a concrete stake or contradiction, tells the story in plain language, and closes with one action a viewer can take, such as running the trust/accountability diagnostic as a team exercise or reviewing offboarding access.
A sixth short piece can cover the S.A.F.E.R. concept once the tool is documented from a primary source.
The series can include a one-page self-check that asks teams to place themselves in a zone and name one behaviour to change, giving the training company a lead-in to its own programme.
This follows the established format — short, single-idea videos with a hook and a takeaway — and stays within the culture and human-risk subject matter covered in the posts.
Agree commercial terms directly because no published sponsorship route appears, and request comparable video performance and audience data before setting reach expectations.
If the client wants verified breach figures or the full S.A.F.E.R. method, collect that information from primary sources before scripting those episodes.
Consider John C. when a series needs to land with a board or C-suite audience rather than frontline staff.
Read more
The posts are written from the perspective of both a healthcare CIO and a board director.
One argues that sitting on a board taught more about leading a business than the CIO role or an MBA, and frames governance as the means to ask whether strategy is clear, investments are prioritised well, risk is managed, the business is financially viable and the right leaders are being developed.
The other argues that current cyber security knowledge is table-stakes for a healthcare CIO and lists what that covers: medical device and IoMT risk, identity and access management, Zero Trust, ransomware resilience, third-party and supply-chain risk, incident response, AI-enabled threats and clinical downtime.
A training company selling governance-level cyber risk understanding, or a sponsor whose buyer is a CIO or board member, gets a closer match on audience and vocabulary than a staff-facing culture series would offer.
The posts are written, not video, and don’t show Steve S. working in the short-video format this campaign is built around.
They also don’t cover team-level security culture, trust and accountability, or how an organisation behaves when something goes wrong.
The audience is senior and narrow, so a programme aimed at general staff would need different creative.
No audience, engagement or commercial-availability information is published; check John C.’s page before shortlisting to confirm reach and sponsorship availability.
Consider Mark Brown when a human-risk campaign needs behavioural-science grounding rather than a culture framework.
Read more
The posts take a named argument or a live campaign and explain the psychology behind it.
One unpacks the NCSC’s point that attackers can automate freely while defenders hesitate because a fix that breaks something is blamed on the person who made it.
It ties that to omission bias using the 1990 Ritov and Baron vaccination study.
The other dissects a fake software campaign aimed at HR staff through BJ Fogg’s behaviour model—motivation, ability and prompt stacked together so no single suspicious signal appears—and ends with one process change that would break the chain.
For an awareness-training client seeking episodes that cite research, walk through a real attack step by step and end with a concrete fix, this is a closer fit than a four-zone culture model.
Mark Brown also closes that post with a direct invitation to talk privately, offering a visible contact route.
The posts are analytical and written, not short videos, with no recurring series structure or on-camera teaching.
The subjects are narrower: attacker-versus-defender asymmetry and one HR-targeted campaign.
They don’t address leadership behaviour, trust or how an organisation reacts when something goes wrong.
A campaign built around a named culture model, a team diagnostic exercise or a promised employee tool would need more than these posts; a client wanting a produced mini-series would be buying a different show.
Consider Derek Boxdell when a campaign shifts from office security culture to industrial or operational technology.
Read more
The posts are built for manufacturing and OT audiences: downtime as an existential risk, with security reframed as production assurance; AI shortening attacker breakout time; and dark factories raising system-dependence risk.
Each is paired with a directive, such as prioritising OT resilience the way uptime is prioritised or designing security into automation rather than bolting it on.
The other post is a monthly field-notes roundup covering human distraction as the biggest security gap, trust as the new battleground after named telecom breaches, and compliance becoming a competitive edge as new rules reshape expectations.
A sponsor targeting plant, OT or manufacturing leaders, or wanting a speaking-and-roundup format instead of a produced mini-series, is a closer fit here than with a general staff-awareness series.
The content sits at the industrial and OT level, so these posts wouldn’t support episodes on general staff behaviour, leadership trust or healthcare incidents.
They’re a conference recap and a trend commentary post rather than a short-video series, and both carry named statistics and third-party breach claims that a client would need to re-source before reuse.
The compliance framing also points to a different buyer: the executive accountable for resilience and regulation rather than the person running awareness training.
No audience, engagement or sponsorship-availability data are published; check Derek Boxdell’s page before shortlisting to confirm reach and availability.
Steve S.'s five LinkedIn posts here cover security culture, human risk, leadership and accountability, and healthcare security incidents.
Each post promotes a short video, but the posts do not include the videos or their transcripts, so descriptions stay with what the post text states, including figures and case details quoted in the Change Healthcare and hospital offboarding posts.
The account's follower count of 3,284, recorded 9 October 2026, is the only audience figure available.
Steve S.'s posts here do not document a sponsorship programme, rate card, inquiry route, client list, or owned business, and they do not mention books, shows, or earlier career work, so those parts of the public profile remain open.
These five posts may not cover Steve S.'s full body of work; where a claim would need the videos, the S.A.F.E.R. tool, or commercial terms, that gap is flagged rather than filled.