As security professionals, we rarely lack good reasons and intentions in our efforts to protect our businesses from cyber attacks. We know that cybersecurity isn’t just about firewalls and software; it’s about people.
How do we turn curiosity into resilience?
When a cyber crisis hits, the last thing you want is to scramble for a plan or find out that your organization is unsure what to do.
This should be the moment when all the prior efforts you’ve put into good preparedness practices with your team make all the difference. However, to reach that level of preparedness, it often requires that people and organizations recognize and feel a need for changes in security behavior before any incident occurs. And that can be a challenging task.
The simple reason for this may be that safety work is not just a technical exercise. It’s transformational work. It’s because driving change across an organization isn’t just about presenting risks: it’s about creating experiences that resonate.
Cyber preparedness requires collaboration across departments, among people with different goals and perspectives. That’s why storytelling, engagement, and empathy are key tools for inspiring change.
Why a good story matters
We can jokingly say that, to become a good security leader, skills in Excel and PowerPoint need to be developed. It is with hard facts and convincing arguments that we can achieve results when cybersecurity people no longer preach to the (security) choir.
Take inspiration from change management expert John Kotter. In The Heart of Change, we’re told the story of someone who successfully inspired change in his organization not through spreadsheets, but through a tangible experience and an emotional reaction.
Jon Stegner, a senior executive at a large company, was convinced that it could save up to $1 billion over five years by changing the company’s purchasing practices. Instead of delivering an Excel sheet to his management, he asked a summer intern to investigate how many different types of gloves the company was purchasing across its many factories. The intern’s results? Well, 424 different kinds of gloves with prices ranging from $5 to $17 for essentially the identical product.
With a price tag still attached to each pair, Stegner displayed all 424 pairs of gloves on a boardroom table for the division presidents, who were left dumbfounded by the waste and inefficiency of the company’s purchasing.
Turn theory into relatable practice
Similarly, cyber exercises, or emergency preparedness exercises, can be an opportunity for people to experience the importance of cybersecurity and, often, its absence.
It’s often been the case that emergency preparedness exercises are carried out using PowerPoint. This can be resource-intensive when creating comprehensive and realistic exercises, and you usually end up with a slightly less engaging tabletop exercise than you would have liked.
We designed PrepJam to be an interactive exercise tool that sparks the conversation about cybersecurity across your organization. PrepJam transforms tabletop exercises into engaging, memorable experiences, so your team is not just informed but truly prepared when it matters most.
Here's how you can have an engaging cyber exercise with PrepJam:
Interactive storylines: Choose from the different interactive features to build a scenario that evolves based on participants' responses. Create a realistic experience that mirrors the real-life complexity of cooperating under a cyber incident.
Realistic methods: Participants receive SMS messages and phone calls, automatically triggered to simulate real-time events and hacker tactics.
Collaborative decision-making: Scenarios encourage both personal reflection and team discussions at different stages of the exercise. Your participants' responses are always anonymized, so everyone feels at ease to share their thoughts without feeling exposed
The Wheel of Misfortune: Add real-life unpredictability into your story by spinning the "wheel of misfortune". Let participants experience that unexpected events and (un)luck sometimes play a big role.
Effortless reporting: Automatic logging of insights and decisions makes final reporting and post-exercise analysis a breeze.
Rather than letting them hear cold facts about risks, threats, and vulnerabilities, you can help your team get a sense of how they would react when the crisis hits with a PrepJam scenario.
