How to create trust for your security team through simple communication tactics

How to create trust for your security team through simple communication tactics

Speakers: Kelsy Luengen

Conference: CrikeyCon

YouTube: https://www.youtube.com/watch?v=QboCHGLHPSA

Overview

In her CrikeyCon talk, "How to create trust for your security team through simple communication tactics," Kelsy Luengen addresses a pervasive challenge for cybersecurity professionals: the perception of security teams as "blockers" rather than "enablers." Luengen, drawing heavily on her background in criminology and behavioral economics, posits that the key to overcoming this perception and fostering a truly secure organizational culture lies in strategic, empathetic, and consistent communication. The talk is a compelling call to action for security teams to re-evaluate their communication strategies, emphasizing that building trust is not merely a "soft skill" but a fundamental driver of effective security outcomes.

The core premise of Luengen's presentation is that traditional, enforcement-centric approaches to security compliance are inherently limited. By reframing the security team's role and consciously employing specific communication tactics, organizations can transition from a state of grudging instrumental compliance—where individuals only adhere to policies to avoid punishment—to normative compliance, where they willingly embrace security practices because they understand their value and fairness. This shift, Luengen argues, empowers employees to become "place managers" of their own data and digital spaces, significantly amplifying the organization's overall security posture.

Luengen's insights are particularly relevant in today's complex threat landscape, where human error remains a leading cause of breaches. Her approach provides actionable tools for security professionals to cultivate a proactive, collaborative security environment, making their jobs easier and more impactful. The talk offers a refreshing perspective, urging security teams to leverage the science of human behavior to transform their internal reputation and, consequently, their effectiveness.

Background

▶ Watch: Introduction: Building trust for security teams (0:00)

The foundational premise of Luengen's talk stems from an intriguing parallel she draws between security teams and law enforcement. Having worked in evidence-based policing, Luengen views security professionals as agents of enforcement within an organization. This perception, whether intended or not, shapes how employees interact with and respond to security directives. Security teams are seen as monitors, policy enforcers, and investigators of "cyber crime," leading to a dynamic often characterized by fear of punishment rather than willing cooperation.

This dynamic gives rise to two distinct forms of compliance: instrumental compliance and normative compliance. Instrumental compliance is driven by the fear of negative consequences. In a policing context, this means not speeding because one fears a fine or losing license points. Applied to cybersecurity, it manifests as employees doing "just enough" to avoid getting caught—e.g., not clicking a phishing link solely to avoid additional training, or using a "unique" password by merely changing a "1" to a "2." Luengen highlights the significant limitations of this approach: it demands constant monitoring and resource expenditure from the security team, as individuals are only motivated by external deterrence. This leads to a reactive security posture, perpetually playing catch-up.

To move beyond these limitations, Luengen introduces the concept of third-party policing, a strategy she observed in law enforcement. Recognizing finite resources, policing units in the 1980s and 90s sought to "get people on side" by empowering community groups and other organizations to become "place managers." In the corporate context, this translates to employees actively taking ownership of their secure environment. When individuals understand why security matters to them—e.g., a breach could jeopardize their job, increase stress, or impact company finances—they transition to normative compliance. Here, compliance isn't driven by fear, but by a belief in the fairness and collective benefit of the policies. They follow standards because they perceive them as just, fair, and ultimately beneficial to everyone, including themselves. This shift empowers individuals to become active participants in security, proactively reporting issues and enforcing standards within their own domains, thereby making the security team's job significantly easier and more effective.

Key Findings

▶ Watch: Shifting from instrumental to normative compliance (4:15)

The central discovery presented by Kelsy Luengen is a clear causal chain: trust within an organization directly leads to normative compliance, which in turn fosters place managers, culminating in proactive security. This represents a fundamental shift from traditional reactive security models that rely heavily on enforcement and instrumental compliance.

Luengen identifies three core elements crucial for any effective communication strategy aimed at building this trust:

1. What's the message? The content and framing of the communication.
2. Who's the messenger? The individual or group delivering the message.
3. What's the medium? The channels through which the message is disseminated.

To craft the "message" effectively, Luengen distills her policing research into four key principles that promote legitimacy, fairness, satisfaction, and cooperation:

• Trustworthy motives: Clearly articulate the "why" behind security actions, connecting them to tangible benefits for the individual and the organization.
• Neutrality: Ensure policies and actions are perceived as fair and applied equally to everyone, avoiding any suggestion of blame or singling out.
• Dignity and respect: Acknowledge the user's situation, potential workflow impacts, and treat them as subject matter experts in their own roles, avoiding condescension.
• Voice: Provide avenues for dialogue and feedback, allowing individuals to feel heard and participate in the process rather than being dictated to.

Regarding the "messenger," Luengen categorizes communicators into a matrix based on trust and technological authority, advocating for leveraging trusted translators (high trust, low tech authority, e.g., L&D teams, line managers) and trusted experts (high trust, high tech authority, e.g., a CISO who communicates well) to deliver high-impact messages. She cautions against relying on individuals with low trust and low technological authority.

Finally, for the "medium," Luengen emphasizes the critical role of repetition. Citing marketing principles, she introduces the "rule of seven," which suggests potential customers need to encounter a message at least seven times before taking action. In the modern, attention-fragmented digital landscape, this has evolved to require 20 to 50 touch points across multiple channels. This ensures that messages cut through information overload and competition from other departments, leading to genuine understanding and behavioral change.

Technical Deep Dive

▶ Watch: Crafting the message: Motives, neutrality, respect, voice (10:00)

The technical deep dive into Luengen’s communication strategy focuses primarily on the "What's the message?" component, dissecting the four principles that transform security communications from burdensome directives into trust-building engagements. She illustrates these principles using a common security scenario: blocking file-sharing services like Google Drive, Dropbox, or WeTransfer.

1. Trustworthy Motives: Explaining the "Why"

Traditional block pages often display a blunt "Access to the application or website has been blocked." Luengen argues this approach immediately positions security as a "blocker." Instead, the message must articulate the underlying trustworthy motives. It's not enough to say "it's good security"; employees don't inherently care about that. The "why" must resonate personally or organizationally.

• Initial Message: "Access to the application or website has been blocked."
• Improved with Trustworthy Motive: "Access has been blocked because this protects our company's sensitive data."
• Further Improvement (depending on culture): "Access has been blocked to protect your data and our company's sensitive data."
• For regulated environments (e.g., banks): "Access has been blocked to protect our organization's sensitive data and ensure we meet our compliance obligations."

This small addition shifts the perception from arbitrary restriction to purposeful protection, linking security actions to tangible benefits like avoiding overtime, maintaining customer trust, or preventing redundancies caused by a breach.

2. Neutrality: Ensuring Fairness and Collective Responsibility

The next step is to convey neutrality, ensuring the message is perceived as fair and universally applied, not targeting any individual or department. This fosters a sense of collective responsibility rather than singling out perceived "bad actors."

• Building on Trustworthy Motive: "Access has been blocked to protect our organization's sensitive data."
• Adding Neutrality: "All file sharing services not listed in the data sharing policy have been blocked for all [organization's] employees."

This communicates that the policy applies equally to everyone and provides a clear reference point (the policy) for further understanding, empowering employees with information rather than leaving them in the dark. It removes the perception of blame and encourages cooperation.

3. Dignity and Respect: Acknowledging Impact and Empathy

Security measures often disrupt workflows. Ignoring this impact can breed resentment. Luengen stresses the importance of showing dignity and respect by acknowledging the user's situation and potential inconvenience. This demonstrates empathy and treats employees as subject matter experts in their own roles, even if they lack security expertise. A condescending tone, such as a blunt "Log a ticket" response, erodes trust.

• Building on previous points: "Access has been blocked to protect our organization's sensitive data. All file sharing services not listed in the data sharing policy have been blocked for all [organization's] employees."
• Adding Dignity and Respect: "We understand that this may impact your workflow. We appreciate you working with us to help maintain our customers' trust and our organization's security."

This simple addition acknowledges the user's experience, validates their potential frustration, and reinforces the trustworthy motive, transforming the security team from a "blocker" into an "enabler." Luengen even suggests using tools like Chat GPT to help draft these empathetic and well-structured messages, noting that she uses it to check if her messages are "80% correct."

4. Voice: Fostering Dialogue and Engagement

Finally, communications must provide a voice, allowing for dialogue and feedback. Security should not be a one-way imposition. This also involves associating messages with a specific, identifiable security team or individual, rather than a "no-name faceless brand."

• Building on all principles: "Access has been blocked to protect our organization's sensitive data. All file sharing services not listed in the data sharing policy have been blocked for all [organization's] employees. We understand that this may impact your workflow, and we appreciate you working with us to help maintain our customers' trust and our organization's security."
• Adding Voice: "If you believe that the site or application is being incorrectly blocked, or you'd like to discuss alternative processes or solutions, please contact us via [specific contact method, e.g., email address, internal ticketing system]."

This crucial step transforms a "no" into an invitation for conversation, showing that the security team is open to collaboration and finding solutions. It makes security a shared responsibility and allows for exceptions or alternative solutions to be discussed, further solidifying trust and engagement.

By combining these four elements, a simple block page message evolves from a perceived impediment into a comprehensive, trust-building communication that educates, respects, and invites collaboration.

Demo / Proof of Concept

▶ Watch: Selecting the right messenger for impact (18:00)

While this talk did not feature a live technical demonstration of a specific tool or a complex Proof of Concept, Kelsy Luengen effectively used a practical, real-world scenario to illustrate her communication principles. The "demo" was a step-by-step transformation of a standard, unhelpful block page message into a comprehensive, trust-building communication.

The scenario involved an employee attempting to access a blocked file-sharing service (e.g., Dropbox, Google Drive, WeTransfer). The initial, common response displayed to the user is a terse: "Access to the application or website has been blocked." Luengen then progressively enhanced this message by applying each of her four communication principles:

1. Adding Trustworthy Motives: The message evolves to include why the service is blocked, such as "This protects our company's sensitive data," or "It ensures we meet our compliance obligations." This immediately provides context beyond just "security for security's sake."
2. Adding Neutrality: The message is further refined to emphasize that the policy applies universally: "All file sharing services not listed in the data sharing policy have been blocked for all [organization's] employees." This ensures the user understands they are not being singled out and points them to a resource for more information.
3. Adding Dignity and Respect: An empathetic statement is included: "We understand that this may impact your workflow. We appreciate you working with us to help maintain our customers' trust and our organization's security." This acknowledges the user's experience and shows the security team's understanding of business impact.
4. Adding Voice: Finally, a mechanism for dialogue is provided: "If you believe that the site or application is being incorrectly blocked, or you'd like to discuss alternative processes or solutions, please contact us via [specific contact method]." This opens a channel for constructive engagement rather than leaving the user feeling powerless.

This iterative process demonstrated how a few carefully chosen words, guided by behavioral economics principles, can fundamentally alter user perception of security initiatives. It served as a powerful proof of concept for the effectiveness of her communication framework in transforming a negative interaction into a positive, trust-building one.

Defensive Implications

▶ Watch: Summary: Key takeaways for building trust (26:40)

Kelsy Luengen's talk offers profound defensive implications for security teams, shifting the focus from purely technical controls to the critical human element. By embracing her communication tactics, defenders can significantly enhance their organization's resilience against a wide array of threats.

Firstly, the most significant implication is the cultivation of normative compliance. When employees trust the security team and understand the why behind policies, they move beyond merely avoiding punishment. They become proactive place managers, taking personal responsibility for securing their data and digital environment. This means they are more likely to report suspicious activities, adhere to data handling best practices, utilize password managers, and challenge unknown individuals in secure areas—all actions that extend the security team's reach without requiring direct oversight. This distributed security vigilance acts as a powerful, low-cost defensive layer against phishing, insider threats, and physical security breaches.

Secondly, improving communication leads directly to proactive security. If employees feel comfortable and trusted enough to flag potential risks early, the security team can address vulnerabilities before they escalate into full-blown incidents. This saves critical time and resources that would otherwise be spent on reactive incident response. For example, an employee who understands the collective benefit of reporting a strange email is an early warning system against a potential organizational compromise.

Thirdly, the tactical application of Luengen's four communication principles—trustworthy motives, neutrality, dignity and respect, and voice—should be integrated into every security interaction. This includes:

• Policy Rollouts: Instead of simply publishing new policies, explain the personal and organizational "why" behind them, acknowledge potential workflow impacts, ensure fairness, and provide channels for feedback.
• Incident Response Communications: When communicating about an incident, maintain neutrality, express understanding, and explain the steps being taken and why, building trust even in times of crisis.
• Awareness Training: Move beyond generic "don't click this" messages to engaging narratives that build empathy and demonstrate the value of secure behaviors.
• Tool Deployments: When introducing new security tools (e.g., MFA, EDR agents), explain the benefits, acknowledge installation challenges, and offer support channels.

Finally, strategic use of messengers and mediums is crucial. Leveraging "trusted translators" like line managers or L&D teams can effectively disseminate security messages to non-technical audiences, while "trusted experts" can handle high-impact technical communications. The emphasis on 20 to 50 touch points across diverse channels (emails, Slack, posters, presentations, brown bag sessions, gamified exercises, induction trainings) ensures that critical security messages cut through information overload. This multi-channel, repetitive approach reinforces key behaviors, turning them into ingrained habits rather than one-off directives. By consciously implementing these strategies, security teams can transform their organizational standing, reduce friction, and build a more robust, human-centric defense.

Key Takeaways

• Trust Drives Compliance: Building trust within an organization is paramount for achieving normative compliance, where employees willingly adhere to security policies because they perceive them as fair and beneficial, rather than out of fear of punishment (instrumental compliance).
• Empower Place Managers: Normative compliance transforms employees into "place managers" who take active ownership and responsibility for security in their respective areas, significantly extending the security team's reach and enhancing overall organizational security.
• Proactive Security Through Communication: Trusted place managers are more likely to report potential issues early, enabling the security team to act proactively and prevent incidents, thereby saving time and resources.
• Four Pillars of Effective Messaging: All security communications should incorporate trustworthy motives (explaining the "why"), neutrality (fair and equal application), dignity and respect (acknowledging user impact), and voice (providing channels for dialogue and feedback). Tools like Chat GPT can aid in crafting these messages.
• Strategic Messenger and Medium Selection: Choose the right messenger (leveraging trusted translators and trusted experts) and utilize multiple communication mediums (e.g., long-form articles, instant messages, presentations, posters, gamified exercises) to ensure messages are heard and acted upon.
• Repetition is Key: Due to information overload, security messages need to be delivered consistently and repeatedly, aiming for 20 to 50 touch points across various channels to achieve genuine understanding and behavioral change.

About the Speaker(s)

Kelsy Luengen is a dynamic and insightful security professional with a unique background that deeply informs her approach to cybersecurity. A former American cheerleader, she brings an energetic and engaging communication style to her presentations. Beyond her cheerleading past, Luengen is a former criminologist, having worked in evidence-based policing. In this role, she focused on quantitative analysis to determine the effectiveness of policing strategies, drawing parallels between law enforcement and cybersecurity teams as "agents of enforcement."

Her academic journey continued with doctoral research in cybersecurity, where she investigated how individuals recognize email-based threats and explored low-cost alternatives, such as behavioral "nudges," to improve online threat recognition. This research, though initially finding that some nudges alone were ineffective, propelled her into the field of behavioral economics and its application to security awareness and change management. Kelsy Luengen now works in this space, focusing on how to genuinely change behavior rather than just imparting knowledge about security, aiming to get people to work with security rather than merely know about it. Her expertise lies in translating complex behavioral science into practical, actionable communication strategies for security teams.