Combating Complacency with Transmedia Storytelling: A Solution for Human Risk Management

Human risk management addresses one of the biggest cybersecurity threats: complacency. A solution lies in an unexpected yet powerful tool: transmedia storytelling. By leveraging emotionally-engaging, participatory narratives across multiple platforms, organisations can effectively address human risk management by changing the security conversation and mindset.

We often talk about developing a “security culture”. But what is “culture”? It’s a set of beliefs. And beliefs the are stories we tell ourselves. So if we reverse that… storytelling creates good beliefs which result is good actions which result in a security culture.

Why Transmedia Storytelling Works

Transmedia storytelling involves creating a cohesive narrative experience across various channels. In the context of cyber security, this could be online exercises, posters, internal social media, email, meetings. You’re probably doing all this already but are you just delivering information rather than emotionally engaging your staff? Without emotion, lessons are rarely learned, meaning that the purpose and reason for a security control is not understood and the result might be the control is sidestepped at a crucial moment.

Transmedia storytelling can really help human risk management in the following ways:

1. Engagement and Retention
   Traditionally, eLearning struggles with attention, understanding and retention. Transmedia storytelling uses participatory narrative to create emotional hooks and connections between the security control and the audience behaviour. This influences beliefs that reinforce good security practice.

2. Addressing Human Complacency Threat
   Staff need to feel that their actions matter. They are the solution, not the firewall or the antivirus software, not the security department: it’s their day to day actions that create security. Transmedia storytelling can reduce the threat of complacency by influencing beliefs and reinforcing beneficial beliefs that lead to beneficial actions.

3. Realistic problems, addressed
   Through exercises, staff can experience scenarios that mirror realistic workplace situations. These interactive rehearsals reveal the consequences of good and bad actions. Experiencing consequences creates an emotional bond which helps with retention.

4. Building a security culture
   Our behaviour and motivation is affected by beliefs. Transmedia storytelling puts the audience at the centre of the story and when people see themselves as part of the story we can address erroneous beliefs and so incline staff to adopt desirable behaviours.

How to begin

Implementing transmedia storytelling for human risk management start with the following six considerations:

• Goals – which security controls do you want to address?
• Audience – which staff roles is this targeted at?
• Platforms – where can we get our message seen by this audience?
• Story – what narrative will spark interest and attention?
• Experience – how is the story delivered across the platforms?
• Execution – is this is an ongoing initiative or a single campaign?

Answering these questions will help you scope the project and be ready to create an emotional connection to your staff to have them appreciate why the security controls are necessary and how they play a central part in success.