They put a fat green 0% on the slide and everyone nodded like it meant victory. Gary, a builder with plasterboard and vans on his mind, sips his tea and wonders why cyber security suddenly sounds like someone else’s problem — until the hosts pull that cheerful number apart. What looks like perfect protection can be a mirage: a workforce trained to pass one test but not to spot the real, messy tricks criminals use when a delivery is late or an invoice changes. In this episode, Noel and Morvan walk Gary — and you — through the slow unravelling of that comforting 0%. We follow a year of simulated attacks from a vendor’s dataset and watch a story unfold: clicks fall, then spike, and finally settle — not because people got stupider, but because the tests got harder and started catching the vulnerabilities that easier simulations missed. Through vivid examples (the parcel everyone waits for, Dave who closes a window and hopes no one noticed, and a frantic phone call that saves the company money), the hosts tease out the real lessons. Clicks are not binary verdicts; they are one link in a chain that includes credential submission, MFA failures, and the crucial moment when someone chooses to report the suspicious message. Reporting becomes the episode’s hero: a single employee who says “this looks odd” can protect an entire team. The conversation turns practical — one big, easy-to-press button, quick acknowledgement, and a culture that thanks people for coming forward instead of shaming them. The narrative pivots from blaming individuals to building systems that survive human error. By the end you’ll see why insurers and dashboards obsessed with a single percentage get a dangerously incomplete picture, and why better metrics — credential leaks, reporting rates, testing difficulty, and report speed — reveal a healthier story. The episode closes with four concrete steps Gary can take on Monday morning and a rallying cry: don’t chase perfect green ticks; build processes that turn your people into the sensors that actually keep you safe.

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related