Defense By Design

Some risks aren't created by bad habits. They're created when we get GOOD at them. 🤣

Think about it, the first time we bypass a procedure, ignore a warning sign, share something we probably shouldn't, prop open a door, reuse a password, or say “we've always done it this way”—we may recognize the risk. But do it often enough without a negative consequence, and something interesting happens -- risk starts feeling normal.

Not only is this nightmare fuel for , but it should be for and as well.

That's the problem with habits. Eventually we stop making a decision -- and simply start repeating one. So maybe the better question isn't, “Do we have any bad habits?” It's “Which bad habits have we gotten really GOOD at?” YIKES! 😮

I know someone who can help.

Three hospital employees were attending active-shooter training. At that very moment, an actual shooting was taking place inside their hospital.

Think about that for a moment...

In June, three IT interns at a Delaware reportedly had an argument. One asked to leave, then later returned to the hospital with a handgun. Two coworkers were shot; one died. Full story linked in comments section below.

At the time, visitors were screened for weapons -- but employees were not. The alleged shooter was still an *active employee* with *valid access.* Consider those two key factors.

Yes, absolutely, 100% active-shooter training matters. It prepares people for what to do once violence begins. In our world today, this approach is totally justified and relevant -- no issues here. But what are we doing *BEFORE* that moment, a point at which "prevention" may still be applied?

We aren't trying to predict whether a person WILL act. We're trying to understand and potentially then mitigate the conditions that could support THEIR WILL to act. This involves across all departments.

Reaction matters -- but so does recognition. What are we looking for *BEFORE* the bang?

I know someone who can help.

Sometimes the WORST thing you can do during a reputational crisis...is RESPOND to it. Wait...WHAT?!

I ran across an interesting article this morning about the seemingly endless stream of brand controversies playing out on , and it got me thinking. Social media can make something LOOK enormous very quickly. Comments, shares, angry posts, headlines, trending conversations --are those the FACTS -- or merely the ARTIFACTS? Is the conversation growing—or already fading?

Full story linked in comments section below.

Is customer behavior actually changing? Is trust really being damaged? Or are we witnessing something that LOOKS like a reputational crisis because we're measuring the visibility of the reaction rather than the impact of it? Because sometimes an organization jumps into a controversy to “manage” it, and succeeds in giving a dying story another news cycle. YIKES! 😬

Reputation management isn't merely knowing HOW to respond. Sometimes it's knowing WHETHER to respond. Big difference!

Before you manage the crisis, make sure you know what the crisis actually *IS* -- or if there is even a crisis at all.

I know someone who can help.

Technology can be PART of the answer without being ALL of the answer.

An interesting piece from American Nurse looks at workplace violence prevention through a layered approach involving people, processes and technology. And that's an important distinction, and not just for or . Full story linked in comments section below.

Weapons detection may help identify a weapon—but PEOPLE still have to know what happens next. A duress device may summon assistance—but PEOPLE still need to recognize when to use it, trust that it will work, and know that someone will respond. De-escalation training may provide useful skills—but those skills still have to be reinforced, supported and applied when circumstances change and factor in employee turnover.

I've said for decades, "there are no such things as safe or unsafe 'places' -- only safer or unsafe 'people'." That is a paradigm shift for most who usually quote the converse.

Smart technology can certainly make places 'safer.' But perhaps the better question is: "What makes technology 'SMART'—the technology itself --or the PEOPLE who know how to use and leverage it?"

Particularly timely reading for me this week as I prepare to discuss emerging risks and emerging responses with leaders in Iowa on Thursday

I (and they) know someone who can help.

The technology may be new, but the *LURE* isn't.

Years ago, when teaching people how predators and offenders influence decision-making, one of the techniques I addressed was the "Authority Lure." Think fake police officer, fake security officer, truant officer, etc. Someone presenting themselves as having a position or authority that encourages another person to comply. Now, fast-forward to 2026.

Microsoft Security Research (story linked below in comments) recently identified a campaign involving more than a million financial-fraud emails in which attackers impersonated company executives and attempted to convince accounts-payable personnel to process ACH payments approaching $50,000. The emails incorporated executive identities, fabricated invoices and supporting correspondence designed to make the request appear legitimate.

AI may make the ARTIFACT more convincing. But what is actually being leveraged?

***AUTHORITY***

The recipient isn't merely responding to an email. They're responding to who they believe is BEHIND the email. That's why I'm increasingly interested in the HUMAN dynamics surrounding DATA security, something every and those in or should be as well.

We can improve the technology used to identify fraudulent communications—and absolutely should. But what happens when the communication successfully reaches a person who believes someone with legitimate authority is telling them to act?

The technology has changed. The HUMAN influence being exploited really hasn't. I'll be exploring this very dynamic next month with a room of banking, financial and treasury professionals. Why? Because sometimes understanding the newest risks requires recognizing some very OLD behaviors -- and approaches.

On this one? Oh yes, I KNOW someone who can help!

There is an interesting detail hiding inside this story. And appropriately enough, it isn't necessarily where you might first be looking.

According to investigators, those responsible for this jewelry-store robbery first entered a vacant business next door, reportedly moving in and out of that space for hours before cutting through the adjoining wall.

But here's what makes that particularly interesting --this isn't a new tactic. The Jewelers' Security Alliance has long warned about burglars entering jewelry stores through roofs, sidewalls and neighboring premises. In fact, JSA reported 53 wall-entry burglaries in 2024 alone—up 165% from the previous year.

So perhaps the more interesting question isn't how the criminals got into THIS jewelry store. Who was paying attention to the place where nothing was supposed to be happening? Risk management doesn't end at your property line nor restricted to the square footage of your leased space. For my friends out there, take note.

The jewelry store contained the valuables. It was the obvious place to protect—and therefore the obvious place to watch. The vacant business next door? Nothing was supposed to be happening there.

Next month I'll be speaking to owners of and companies, and stories like this provide an interesting reminder for those paid to look at risk on behalf of OTHER PEOPLE: Are we merely looking where our clients are looking—or are we helping them see where they're NOT?

Criminals don't always have to defeat the security measures protecting what they want -- sometimes they simply take advantage of where we're not looking. "Misdirection" is not simply a tool of magicians.

I know someone who can help.

Over the span of roughly a month, I'll have found myself in wide variety of "rooms."

Rooms with risk professionals, security professionals, municipal employees, healthcare professionals, commercial property professionals and financial professionals—as well as in individual conversations with executives and business leaders representing still other industries.

On paper, those "rooms" and audiences don't appear to have much in common. That's what makes what they DO have in common so interesting.

Different industries, responsibilities and exposures—yet many of the conversations keep circling back to the same things: trust, access, influence, assumptions, judgment, relationships and human behavior.

We tend to organize risk according to industries and departments. Risk doesn't necessarily organize itself that way. Circumstances change and consequences change. Even the language used to 'describe' the risks changes.

But the HUMAN variables keep walking into every room. Perhaps that's why one of the simplest questions I ask continues to work in virtually every one of them: "What do we have that others might want?"

Different rooms produce different answers. That's where the interesting conversations begin.

I know someone who can help.

As risks change, should the role of the risk professional change with them?

I had the opportunity today to spend time with a group of and risk professionals discussing three areas of exposure I work with regularly:

PHYSICAL RISKS - DATA RISKS - REPUTATIONAL RISKS

What struck me afterward wasn't simply the positive feedback on the program. It was the number of people who asked for the questions we'd discussed so they could 'continue' the conversation, whether with their teams, in their own professional development, or simply to broaden how they think about risk. And perhaps that's worth considering - the conversation itself.

Maybe helping clients manage risk isn't only about helping them TRANSFER the risks they've already identified. Maybe it's also about helping them RECOGNIZE the risks they haven't. Nobody has to be an 'expert' in everything.

But as the risks facing organizations become more interconnected, perhaps one of the greatest values a risk professional can provide is knowing which questions to ask—and when another conversation needs to begin.

Where does “insurance” end and “risk advisory” begin—and does the CLIENT even care about that distinction?

I know someone who can help.