Your Security Culture Might Be Made Up

Every company swears it has a security culture. Every exec says security is everyone’s job. Then something breaks, and suddenly nobody owns it.

On Episode 4 of the Truth in Cyber podcast, Michael Kennedy (Ostra Security) and Oscar Minks (FRSecure) welcomed Matt Lee from Pax8 to pick apart one of the most overused phrases in the industry. Matt didn’t ease into it.

“Security culture is a way for us to define something we haven’t solved, and we say we can just culturally solve this.”

Matt Lee, Pax8

His example: a concrete company that has to hit a job site every 30 minutes doesn’t talk about “truck culture.” It buys spare trucks, runs a repair shop, and keeps backup crews on call. The company decided what matters and paid for it. Security deserves the same treatment: real budget, a real owner, and systems that make the right move the easy one.

Quit dunking on your users

Users take the blame for everything. Matt’s take is that they get it right almost all the time, and when they slip, somebody usually handed them a flimsy setup. If 92% of your people didn’t click the phish, maybe lead with that.

Oscar shared a story about a company that gave a candy bar to anyone who reported something sketchy, mistakes included. At FRSecure, the top phishing reporter each quarter is usually a salesperson. That’s the number worth watching. Report rates tell you way more than click rates ever will.

Leaders go first

If the people at the top don’t care, nobody else will either. Matt pointed to the Govern function recently added to NIST CSF 2.0 and the CIS Controls, which he boils down to “the will of a company enacted.” Pick a framework and actually live it. Checking boxes for an auditor doesn’t count.

Nobody on the panel claimed to have it all figured out. They did agree the industry needs to stop admiring the problem and start owning it.

Catch the full episode for the rest, including the day Oscar was convinced his bulldog hacked him.