Suggestions
Jason Hoenich (hey-nick)
Canary in the Security Awareness Coalmine | Arctic Wolf
Jason Hoenich is a renowned figure in the security awareness sector, known for his expertise as a speaker and blogger on this vital subject.
With a career spanning over a decade, Jason has honed his skills in developing top-tier awareness programs for prestigious companies such as The Walt Disney Company, Activision Blizzard, and Sony Pictures Entertainment.
He is the innovative mind behind the widely popular Hashtag Awareness video series, focusing on engaging and compelling content to drive employee involvement in security training.
Jason's philosophy revolves around the idea that traditional, mundane training methods no longer suffice in today's content-rich and engaging landscape; instead, he advocates for captivating content to captivate and educate audiences effectively.
His educational background includes studying Business and Marketing at Penn State University.
Throughout his career, Jason has held key positions such as Vice President - Managed Awareness at Arctic Wolf, President & Founder of Habitu8, Manager of Security Awareness & Training at Sony Pictures Entertainment, and various leadership roles at organizations like The Walt Disney Company, Activision, and Susquehanna Bancshares, Inc.
Prior to his leadership roles, Jason started his professional journey as a Network Administrator/IT Support Specialist at Coldwell Banker Homesale Services Group.
Highlights
It’s disheartening to see how many people still think security awareness is just about phishing simulations and annual training. Certainly, these are key components to a robust program, but there is so much more to them.
A real security awareness program takes time—often 1 to 3 months—just to plan. And it’s not just about putting something on paper; it’s about understanding your company’s culture, risks, and getting everyone on board, from leadership to the front lines. It's having a lot of conversations across the company.
And here’s the kicker: there’s still no clear definition (or, atleast, acceptance) of what “security culture” actually means. We talk about it like it’s the same as organizational culture, but it’s not. This lack of clarity? It’s causing more confusion than it’s solving. (JKJK there's a fantastic book about the work Kai Roer and his team did to define Security Culture).
We need to push past the basics. This isn’t about ticking boxes or following vendor guideance. It’s about building something that’s genuinely woven into the fabric of an organization. During Habitu8's run, I worked with every single customer to help them better understand their program and needs. Every single customer that took the time to complete their program plan and get stakeholder support were wildly more effective than those who did not.
You can't automate that part. You need the human to interpret the nuance of being human, in different roles, scenarios, etc. To account and expect for mistakes and build around them.
Anyway, these are the things I think about at night.
#securityawareness #humanrisk
Earlier this week, Scott Greaux and I debated a bit about phishing simulation stats and how these tools/vendor (in my opinion) are why we now have a rampant misuse of the tools in the form of punitive programs. He asked for data or studies - which I don't have - but I have a vast network of practitioners and my peers who can share their own stories.
So, I'd love to hear your thoughts on the question: Have Phishing Simulations Birthed the Punitive Program Plague?
Please, anyone who has actively managed phishing training programs, what's your experience on this?
#securityawareness #phishingtraining #humanrisk
