Why Security?

We talk with Robert Cicliano about why cybersecurity matters for people who do not work in security and why scams keep working even on smart, capable adults. We dig into how fraudsters build trust, why denial is so common, and why compliance-style training fails to create real risk awareness. 

• why everyday people are targets, not exceptions 
• fraud as a business model built on trust tricks 
• common attack channels like phone, text, and email 
• denial and “it can’t happen to me” thinking 
• why compliance training fails under real pressure 
• what a better approach looks like for spotting risk 

Josh's LinkedIn

Transcript

Meet Robert Cicliano

SPEAKER_00 0:00

Robert Cicliano, speaker, pontificator. We had a little bit of a chance to talk shot before we hit record. And man, I had to stop it and just go, okay, Robert, let's just get on the podcast and save it all for that because you were dropping some real insights that I think people would appreciate, specifically around why do this cybersecurity thing. I know this is a message that we normally preach to companies, and we have the CISO sort of be responsible for the safety of the business and cybersecurity and awareness training well within your wheelhouse here. But it seems that normal folks, which I'm going to say muggles, right? Non-security people, maybe even non-business people, non-technical people, but specifically the people who are not working in cybersecurity, why do it at all? Why is it important?

Denial And The Compliance Trap

SPEAKER_01 0:55

Well, you know, there are um bad actors out there, as we know, who treat fraud as a business, right? I mean, snake oil salesmen have been around for hundreds of years, and they've just changed their tactics, their methodology is still the same. It's uh convincing us that they are worthy of our trust. And today, you know, whether in person, over the phone, via text, or email, they have many vectors, mediums in order to get in touch with us. And they're really good at what they do. People say to me all the time, you know, criminal hackers could use what they know, they could cure cancer. And I'm like, yeah, no, they don't care about curing cancer. These are sociopaths and psychopaths, these are hardcore narcissists, uh predators in human form that um would just be as happy seeing your father homeless on the street broke because they stole all of his money. They could care less about curing cancer. And that's what we're up against. And most of the general public, they don't see themselves as ever being targeted because they don't want to think they would ever be targeted. And they basically do nothing in regards to managing risk because they function in a state of denial all the time. It can't happen to me. And they do nothing. And so we shove, you know, compliance training down their throat and say, okay, do this, don't do that, or else, and expect them to recognize risk effectively when the phone rings, when they get an email, when they get a text message. And I'm here to say that the compliance trap doesn't work, never has, never will, but there's a better way to do it.