Borrowing Brilliance: What Security Awareness and Training Should Steal from Marketing

Auto-generated from the live recording.

0:07Thanks a lot. I'm super excited to spend a little bit of time today. I'll ask some questions and try to involve you guys a few times in here. So if you wanna kind of get your typing chat fingers ready, that'll be good and that'll be helpful and kind of keep this a little bit more dynamic. And I'd like to start off with a question for you guys. So clearly something, caught your interest in the title or the description here. So you probably have at least one answer that you could give to this question. So I'm curious, what kind of things do you wish you could sort of "steal, adopt or borrow" from marketing?

0:46If you wanna drop that in the chat, we can kind of see what you guys are thinking along those lines. And I'll keep an eye on that 'cause I know our time is short. So I would love to hear and read your answers to that. So typically, like I said, everybody has something that pops immediately into mind. Things like budget and visuals and Don Draper, that's a good one, Nick, confidence. And so, as we get started, I just kind of wanna start with, well, why would we look to marketing? Why is that? Why not accounting or finance or some other field?

1:24And I think training and marketing, we both share a common goal, a couple of common goals actually. And if you think about it, we're both trying to get people's attention. And then once we get that attention to help them think and act in new ways. I would say, however, a lot of times, if you compare those two fields side by side, even though we've got the same goals, there are oftentimes very different approaches. And so one of the examples, I think illustrates this pretty well, is if we're a company and we're trying to sell hamburgers and we take it down the hall to the training department, we might fairly often get back something that sort of looks like this, very factual bullet point, basic sort of stuff.

2:16Whereas if we maybe go upstairs or downstairs or wherever the marketers live and take them that same project of wanting to sell hamburgers, the marketers are gonna come back with something that looks like this. And so if we put these two side by side, what is the difference there? What jumps out? And please feel free to drop this in the chat. What's the first thing that jumps out at you? And then maybe, why do we do it so differently? Yeah, care and color, that's a big one, right?

2:51That's an easy one. My guess is one of those will make you more hungry for a Big Mac than the other. Appealing visuals, Ben, yep, absolutely. So I think when you see these side by side, things like color, visual, simplicity, we're gonna get into that a little bit about why the marketers do it differently than us. And we're gonna sort of explore three things that I think we should steal from marketing. There's way more than three, but three is all we got time for today. So the three things I wanna touch on is marketers do a really good job of speaking to our primal brain.

3:31So we'll talk about that. Marketers understand I can't run one commercial and just sit back and watch the sales roll in. So we'll talk a little bit about some branded campaigns. And then another reason I think marketing often gets bigger budgets is because they're data driven and they can tie things back to data. So that'll be the third thing we talk about. So first up marketers speak to the primal brain and just what exactly does that mean, right? There's been a lot of research and a lot of sort of discoveries in the past decade about the two types of thinking that we have as humans.

4:13I don't know if anybody has read this book. It's a really fantastic book by Daniel Kahneman called "Thinking Fast and Slow." And he talks about this concept of system one and system two thinking. If you haven't read it, I highly recommended it. It's really worth the read. And what he talks about is system one is the type of thinking that operates unconsciously and automatically. Whereas system two is what we're gonna be doing when we're doing things like math problems. It requires conscious effort and control.

4:48So we're talking about the sort of the conscious logical side and then the subconscious more emotional reactionary side. If we compare these two types of thinking, our conscious logical thinking is sort of evolutionarily newer, it's weaker, it gets tired easily, you can relate to that. It's effortful compared to our subconscious thinking. It's older, it's been with us for tens of thousands or hundreds of thousands or however many years. It's dominant, it's always on.

5:24We can't turn it off if we want it. It's automatic, it just runs itself. Our conscious mind can process about 40 bits of data per second. And if you compare that to our subconscious side, which can process 11 million, which is a pretty significant indicator of the relative power of our subconscious mind versus what's happening in our conscious mind. That was a big wow for me when I learned that. So what we're saying here is over 95% of our brain activity is subconscious.

6:00And what typically tends to happen is we make decisions and action choices based on our subconscious, and then we backfill it with logic. So for example, there's an experiment. If you're holding a warm beverage and you meet a new person, you will judge that person's characteristic traits as more warm. Same thing if you're holding a cold drink and meet a new person. We would never even understand that, let alone sort of logically describe it. We would have other different logic. So that's kind of an interesting process of what's happening. And all of that is to say, the takeaway here is we don't think as much as we think we think.

6:42So presenting things logically and expecting people to do rational things may not always be the best course of action. A little bit about sort of how this subconscious mind works. It's kind of like a supercomputer that comes preloaded with this database of program behavior. So if I see a moving shadow, move away from that. Those type of if, then type heuristics. And the fascinating thing to me is that we have most of these program behaviors by the time we're six years old.

7:18There's an old book that was titled Everything You Need to Know You Learned in Kindergarten. And I think that that's kind of aligned well with this concept. So I'm curious now to ask you guys another question here. What would you do differently if you were designing for an audience of six year olds? Or would you design anything differently? So if you wanna drop some of those in the chat message here, we'll see what you guys think about that. Probably some similar responses I'm guessing to our initial question.

7:56So yes, more pictures, primary colors, fun, easy words, less text, absolutely. Plain language, 100% simplify. So that takes me straight to the point. Absolutely. That takes me to the next question of as an adult, which of those things do you not like? Because I like all of those things. And if I'm the audience, I would prefer more images, less text, more colorful, more fun, easier words. And so I think really, we're not designing for children or adults.

8:31We're really designing for humans and it's all the same. And it's probably closer to that six year old than maybe most people realize. So one more marketing example. This is from Subaru. They have fantastic marketing campaigns. And our mission for this one would be Subaru makes safe cars. And I was guilty of this in the past. When I first started it out, I thought, okay, we've got training data and charts and facts and figures and logic. I'll just show everybody the facts and figures and logic and everything will be good.

9:11But we have to remember as we're just learning, our logical minds, not what's in control of most of our actions. So instead of those facts and figures, what marketers are really good at is using emotions to tell a story. So I wanna play a short 30 second video of how a marketer, in this case Subaru, does a better option other than facts and figures and tells an emotional story. And this is a really good one. So let's watch this and we'll talk about it.

10:14Poor Subaru, what makes a Subaru a Subaru? So that is a, I think a great example of tapping into that primal brain or subconscious emotional type of thinking. And so I'll ask you, which of those two versions do you think is more impactful, more likely to get attention, more likely to be memorable and tap into those emotional thinking that we're talking about here? Yeah, definitely be, I agree.

10:51I don't know that I've ever had anybody answer A to that one and I just love, if you think about that, it's 30 seconds and it's two words, but holy cow, is that a powerful, memorable experience. And this came up just yesterday in my reading and this was from Cape and Boyd, if you've ever seen them. And this is kind of perfectly captures here. Nothing changes until somebody feels something. And I think that really represents what we're talking about here a lot. And this is not a new concept. So Dale Carnegie said this, you know, decades ago, when you're dealing with people, remember, we're not dealing with creatures of logic, creatures of emotion.

11:33So that's the first part. The first takeaway is speaking to the primal brain. The second part is marketers know that you can't just, as the book says, telling ain't training. You can't just tell somebody once and expect realistic, expect change. So the one and done approach is obviously not the greatest. And if we start to change our viewpoint and think in campaigns and multiple channels and multiple touch points over time, we're going to have better outcomes for whatever our goals are.

12:11And there's a number of benefits in taking this campaign approach. So better learning, better messaging, better communication. There's some learning science like space repetition, space learning things that has got some science and research behind it that a campaign approach aligns with. Depending on how you do that, it's pretty easy to do something like that. So I'm a huge fan of email marketing tools that you can set up automated campaigns, and then they just sort of run themselves. So you could get one of those. And if you know what you want to say, you could set one of those up in an hour or two and have something that runs in a campaign.

12:50So I'm curious if any of you guys are already doing something with the email marketing tools and maybe what you're doing with that. If you would drop that in the chat, I'd love to hear about that as well. And then the last piece that goes along with this is you don't have to rip and replace what you're already doing. So for example, if you have the annual compliance course, take out the important bits and drip them across the year. So maybe you pull out important takeaways and email once a month, so you can kind of get that campaign thinking and reinforce what you're doing in other places.

13:25Like I said, really super easy to set something up like that. And then that example, you've already got content, so it's even easier to repurpose. At Nationwide, so our approach to branded campaign for security awareness and training, you know, we've got two big components to that. So the first is the visual branding. Marketers know that it matters what things look like. Another factor with visual branding is we want, when people see our stuff, we want them to immediately recognize who's putting this out, where it's coming from.

14:00And hopefully that there will be value when they see it. So we're a big company and we've got multiple training departments and we've got HR training and IT training with all these different training groups. People don't know that. And so we wanna sort of help, this is our brand. The other thing that we've been able to do, we've been really lucky is we have a brand character. So it seems like all the insurance companies have characters like Flo and Mayhem and all this sort of stuff. We have our own internal guy. So this is, Josh works in our PNC training team about five or six years ago.

14:38We did a video shoot when Game of Thrones, when Game of Thrones was popular. You can see he's dressed up there. There's a couple images from the video. And he was so popular that I would get emails. Oh my gosh, this guy's amazing. Can I take any other training that he's in? I don't even care what the topic is. So it's a really good illustration of how putting a face and a personality with your brand. It really does engage people and it does get people's attention.

15:16So like I said here, it sort of helps with giving it a face, giving it a personality. Hey, there's a real person back there, even if he is dressed up in costumes and guard. It helps capture attention and create that emotional connection that we were just talking about, speaking to the primal brain. So that's all helping to make it more relatable and more memorable. And then we can also use this in a really flexible way and we can use it across channels and formats. So we can use still images of him in an email campaign. We can use it for, he's done some videos for other topics and stuff.

15:55And so it works really well and we put all of those pieces together. And we think that we've been able to build a really strong, recognizable, valuable security awareness brand internally. He's famous inside Nationwide. I don't think he can go anywhere people know who he is, which is kind of neat. And then the other thing when we're working with campaigns, especially if you use email or use other tools that can give you data and analytics is you get some actionable data. So for example, I can see what's working, what's not working, what are people clicking on?

16:33What are they not clicking on? And that sort of takes us into the fact that I think as a general rule, marketers tend to be more data driven. So quick, brief example that we saw about a year ago, we noticed in our phishing tests that new hires were not performing nearly as well as people who had been here for a little bit longer tenure. So we thought we would start, in addition, everybody gets the compliance course. We thought, well, what if we give them some additional information? And so we built five short weekly emails around phishing, telling them that A, you're gonna get phishing tested, so look for it, how to report, what are the signs, all the things you guys are all familiar with.

17:21But we didn't just do that sort of blindly, we split the new hires into two groups. So the first group got the compliance course and the email support. The other group got the compliance course only. And what we found through A/B testing, which you can also use to test things like headlines and button collars and all that sort of stuff, lots of things you can test with A/B testing that marketer do, but we found the associates who got those supportive extra email touches were much more likely to report phishing attempts than the ones who weren't.

17:57So then we now have data that we can point to and say, this is one thing that we're doing, we've got some data to support that it's working, and now we do that for everybody 'cause we've seen that it makes a difference. This is just a screenshot, depending on the platform you use, you can get more or less data. Most of them have things like, are people opening your emails? Are they clicking on your emails? What particular links or buttons are they clicking in? So you'll have typically a dashboard that's gonna give you some statistics.

18:34You'll see here, I can get opens and clicks, time spent down to individual email addresses who are the most engaged subscribers. And then down here at the bottom, I can see, okay, what links are they clicking? Or in this case, there's a link there that nobody clicked. So what I'm getting is some insights into what is happening with all of my content and my interactions. And I can see if that last link was really important. I probably got to go back and look, does the link work? Did it get in there? Is it framed right? Is the right context? So it starts to give us some insight into that black box instead of just sending content out into the world and hoping for the best.

19:19So I'm just gonna pause here, see if anybody has questions or comments before we go ahead and wrap up here. I've missed anything. Nick, I don't think I missed anything, but I'll let you keep the screen. I don't think we've missed anything. I think that your Game of Thrones-esque mascot really got some excitement. And I am gonna put Mike, your LinkedIn in the chat here. I think some of the stuff you've covered is very insightful. I'm sure people will enjoy it. Thank you, fabulous. And I wish I could say that there was a master plan for that brand character, but he just sort of organically became so popular that we couldn't refuse to not keep using him.

20:01And like I said, he's an internal celebrity. So just kind of a quick recap here. So like I said, there's way more than three things that we could steal, but today we talked about, talk to the primal brain. It's not facts and figures and logic that get people's attention and persuade them to do things. Look at your brand. If you don't think you have a brand, that's probably not good. So look at your brand and see what you might do to make it identifiable in some of the ways that we talked about and others.

20:37And then look for sources. Most of us probably have SharePoint sites that we can get data from or usage from. I mentioned email platforms a couple of times, which are really fantastic for a lot of the purposes of what we do. So those are the three things. Appreciate your time. And then we'll take some questions. If you want a copy of the slides, if you want to link to the Subaru video, this page will also have a video clip of Josh, our guardian. Character, if you want to see a little bit out of that project, you can scan that with your phone or connect with me on LinkedIn.

21:20I'm happy to share any of that stuff and answer questions. But I want to go to Ben's question here while we give anybody else a chance to ask one. Do we do surveys to understand what people can't, to understand what content people understand in any gap? So we do, we try to, anything we put out, always have some form of communication back. So whether that's an email, a submission form, our newsletters is every other week. At the bottom, we always ask the question of, can you please rate this sort of one to five and ability to comment?

21:55So just being available, letting people ask questions, and then actually responding to them, it's amazing. When you give people the opportunity to talk, a lot of times they will. And sometimes, hey, you've got a typo on paragraph three, or other times it's a little more valuable on this maybe gray area and a policy, you maybe need to flesh out a little bit more. So my experience is, as much conversation, going to do presentations in different parts of the company, we have a booking page where people can book us 15, 30-minute, 60-minute presentations for their organization.

22:37A lot of times people are trying to fill needs for speakers. So we try to be a resource for that as well. And so absolutely we try to, surveys is one part of that, Ben, thanks for your question. Well, Mike, I have a question for you, if no one else has one in the chat. Nationwide, you've got all sorts of different employee profiles, right? You've got your policy holder, policy writers, you've got the actual agents in the field, you've got your back office folks, so how have you, especially in the company at large, been able to speak to the different mindsets of people, how they receive information, kind of just the different profiles of your employees?

23:18Yeah, absolutely. So we try to keep that in mind. And one of the things that marketers do that we've tried to also adopt is the idea of personas. So we have a handful of personas that could be a procurement function, it could be executive leadership or management type stuff. And so when we're putting out content, we try to start with, who is this for? Is it targeted? Sometimes maybe instead of one massive communication, we might break that up into segments and then customize it for those audiences.

23:53'Cause the other thing is part of that whole primal brain, the way that that works is we're really good. We have so much stuff inundating us, we're really good. As soon as we think something doesn't apply to us, we filter it out and we move on. I can totally relate to that. So anything we can do to segment and speak specifically to those audiences, the better. So that's a great question. Yeah, I think that's so important. And well, a teaser for anyone else who's hanging around for the next 40 minutes, I'll be doing the next session in this room and kind of speaking towards different groups of people and like being a little bit more individualized is something I'll be talking about.

24:34I'll be sticking around for that one for sure, Nick. Oh, I'm excited, thank you. So what happens if your guard wants to cut his hair, shave his beard? We should have signed a contract to make some exceptions in there. I didn't think of that. I'm gonna write that up here today. Yeah, he's got quite the stranglehold. I mean, you can make a whole content series about that. Fortunately, he's had no fashion shifts or mindset changes in the last five or six years. So he's good enough he could pull off any look. He just would have to reinvent himself.

25:10Yeah, it's a good look. And I think your comment about brand logo is so important. The programs I work with a lot have taken that on. They make a logo, that logo takes on its own kind of marketing power and it does seem extremely valuable. And maybe one last comment here. It really does matter what your stuff looks like. So we say we won't judge your books by its cover, but we do, we can't help it. We're wired that way. Stanford did a study and there's been some other studies of they'll show people to identical content, bits of content.

25:50And the one that looks better is more trusted. Even the usability seems to be better. So design is always a good investment.