The human layer in cyber security: what organisational culture does to your security posture

I have surveyed and interviewed cyber security professionals across the Australian private sector, and the findings point to a clear relationship between organisational culture and security posture. Security posture is not just using the latest technology or Encryption algorithms, we play a more important role In overall security posture of our organisations. Findings in this research say that in organisations with a healthier culture, people comply with policy more consistently and, importantly, report small incidents and near misses far more readily. That early reporting is often what stops a minor security event from becoming a major one. The inverse also holds: where people fear the consequences of speaking up, problems surface late, and they surface bigger.

For a careers audience I would take this somewhere practical. The second half of the session would be about how to read a security team's culture from the outside, during interviews and before you accept an offer. Which questions actually reveal whether near misses get reported or buried, what the answers tell you about how you would be treated in your first serious incident, and why the culture of the team you join will shape your career more than the technology stack will. Attendees leave with a short set of questions to ask their next interviewer.

The research will be published soon, and I will present the findings, not the platform or the organisation behind the data. Same neutrality commitment as above. Either presentation or workshop format would work, whichever suits the program.