---
name: Security Awareness
description: Make safe behavior the easy behavior.
---
# Security Awareness

Most breaches involve a human — phishing, credential reuse, social engineering. Awareness training helps, but training that fights human nature loses. Design security so the easy path is the safe path.

## Principles
- **Reduce the decisions.** MFA that's frictionless (hardware keys, push) gets used; one that's painful gets bypassed. Make the secure option the default.
- **Train on the real threats.** Phishing recognition, credential hygiene, reporting suspicious contact. Not annual compliance videos nobody watches.
- **Make reporting safe and fast.** A user who clicks and reports it in 5 minutes is your early-warning system. A user who hides it for fear of blame is your breach.
- **Test with simulations.** Phishing simulations reveal gaps; pair with immediate training, not punishment.

## Culture
Security vs. convenience is a false trade authored by bad tooling. Good security reduces friction; invest in tools that make secure behavior effortless.