The Praxis Practice Blog
Insights on measuring security behavior, proving what works, and the human side of cybersecurity.
The EU is suing France over NIS2. What that means for your board.
The European Commission is taking France and three other states to court over NIS2. The real signal for boards is not the delay, but what enforcement now expects.
Three regulations. One question: can you prove your controls work?
GDPR, NIS2, and DORA now converge on one demand: not whether you have security controls, but whether you can prove they work. Here is the evidence they require.
Receipts or Results – Part 3: Measuring Security Culture
Part 3 of the Receipts or Results series explores why one-size-fits-all security culture scoring fails, and how baseline-first measurement reveals meaningful behavioral change.
Receipts or Results – Part 2: The Wrong Metric for the Right Question
Satisfaction surveys and post-training snapshots feel like progress but measure the wrong thing. Part 2 of the Receipts or Results series unpacks why culture change demands patience, behavioral signals, and a longer lens.
Receipts or Results – Part 1: The One-to-One Trap
Most human risk programs measure what they put in place, not what it did. This first instalment of the Receipts or Results series examines the one-to-one trap – the assumption that one activity metric maps directly to one outcome – and how to escape it.
Human Risk Management Has a Diagnosis Problem
Not every shift in a risk metric is a behavior problem. Before you blame the driver, check the road. Separating environmental change from behavioral change is where meaningful human risk analysis begins.
Security Lives in the Variance: When Averages Help (and Hurt)
Designing security programs for the "average employee" is the cockpit problem of our era. Risk hides in the spread — and only baselines built around your own people can reveal it.
The Visibility Gap: Why Security Leaders Cannot See Human Security Risk (And What to Do About It)
The biggest threat to your organization is not malware — it is employee behaviors you cannot see. Here is why the industry has a visibility gap, and how to close it.
Your SAT Vendor Says Training Works. Can You Prove It?
Completion rates and phishing click rates do not prove behavior changed. Impact Proof tracks what employees actually do before, during, and after any intervention.
Data: the world's best ventriloquist
The same dataset can genuinely support different decisions without anyone lying. Why framing matters more than the numbers themselves — and how rotating your perspective is the foundation of trustworthy analytics.