The Human Layer
How to close the one gap in your security
that no product covers.
What's inside
Written for business owners, not IT departments.
Nothing in here requires a technical answer, and nothing requires you to buy anything. The first two parts you can act on right now.
Part one
Where you are now
A five-minute self-assessment that gives you a score, and tells you what that score means.
Part two
The rule that still works
One policy, written out in words you can send to your team today.
Part three
Your first thirty days
Four steps, and the three signals that tell you it is working.
Part one
Your score
Add your five numbers together and read the band it lands in.
8–10
You have a program
Keep the reporting visible so it stays that way.
4–7
You have pieces
Most businesses land here, and the gaps are usually cheap to close.
0–3
You have tools, not habits
Start with part two on this page. It takes about twenty minutes.
Part one
Where you are now
Five questions worth answering honestly. None of them need a technical answer: tick the line closest to the truth, then add up your points.
Question 01
What happens between onboarding and the annual policy sign-off?
0 Nothing scheduled.
1 An annual refresher, or something when we remember.
2 Something short and regular that people would notice if it stopped.
Question 02
Who can change payment details, and how is that change verified?
0 Whoever handles it, confirmed by replying to the request.
1 A named person, usually verified, not always.
2 A named person, always verified by a call to a number we already had.
Question 03
If someone received a convincing fake today, who would they tell?
0 They would delete it and move on.
1 They would probably mention it to someone.
2 They know the person, and they would not hesitate.
Question 04
What did your team report last quarter?
0 Nothing, and we have no way of knowing.
1 A few things, informally.
2 A number I could say out loud right now.
Question 05
When something does get reported, what changes?
0 Nothing in particular.
1 We talk about it.
2 I can name a change we made in the last six months.
Part two
One rule and the words to send
Most teams were taught to look for tells: bad grammar, odd phrasing, a logo slightly off. Generative AI removed all of them at once. You cannot train someone to spot a tell that no longer exists, so you stop teaching detection and build one habit instead.
The habit does not care how convincing the message was, which is the whole point. It is also the only part of this you can put in place today, for nothing, without buying anything. Before anyone changes payment details, bank information or account access, they pick up the phone and call the person on a number they already had — not a number from the email, and not a number in the signature.
Copy this into an email to your Team
Before we change any payment details, bank information, or account access, one of us picks up the phone and calls the person on a number we already have. Not a number from the email, and not a number in the signature.
This applies no matter how urgent the request looks, and no matter who it appears to come from. That includes me.
If something is urgent and you cannot reach anyone to verify it, waiting is the right answer. Nobody here will ever be criticised for verifying, and nobody will be blamed for reporting something that turns out to be nothing.
Those two lines matter
The rule does its work in two of its lines: one removes the pressure that makes the scam work, and one removes the silence that hides it.
Why "that includes me" matters
The most expensive version of this scam impersonates the owner. Saying in advance that your own urgent requests must be verified removes the pressure that makes it work.
Why the last line matters
People stay quiet because reporting feels like admitting a mistake. Saying out loud that it never is turns silence into signal, which is the number you want to be able to quote.
Part three
Your first thirty days
No budget approval and no project plan. Roughly twenty minutes in week one, then a short conversation each month.
Week 1
Send the rule
Use your own words if you prefer, and say it once in a team meeting so it is heard as well as read.
Week 2
Name the person
Decide who someone tells when a message looks wrong, and make sure everyone knows the name. One person, not an inbox.
Week 3
Run one simulation
A single realistic phishing test gives you a starting number. The number matters far less than having one to move.
Week 4
Share the result, without naming anyone
What got clicked, what got reported, what you are changing. Naming individuals is the fastest way to stop people reporting.
How you'll know it's working
Three things to watch once the habit is in place. The first arrives in the opposite order to what most people expect.
trending_up
Reports go up before click rates go down
That order is normal, and it is good news. The number to watch is reports, not clicks.
verified
Someone verifies a request from you, awkwardly
They call you back on a number they already had, and feel slightly awkward doing it. That awkwardness is the habit landing.
change_circle
You can name what changed
You can point to something you changed because of what somebody reported in the last six months.
Want the rest of it run for you?
Let's put the human layer on the plan
Ongoing security awareness training, simulated phishing, and a plan. We are here to help.