“Security is about People, not Technology” Gareth Shaw, CEO Pera Prometheus
Key Takeaways
- Not all attempts to gain access to your sensitive information are technical in nature. You and your staff are also vulnerable to being socially engineered.
- Tailgating, covert filming and social engineering succeed because people are conditioned to be helpful and compassionate.
- NPSA guidance identifies people with access to sensitive defence work as targets for hostile approaches and senior leaders, by virtue of their level of access, fit that description.
- Information leaks from careless conversations in public, as easily as from deliberate attacks.
- Information security awareness training works best when it starts with the leadership team, who set the tone for everyone else.
The gap technology cannot close
Information security awareness training addresses a gap that technical controls, such as firewalls and antivirus, are unable to address. The government’s Cyber Security Breaches Survey 2025/2026 found that phishing attacks affected 38% of UK businesses in the last year. These types of attack target the user and only 19% of business’ conducted any staff training or awareness activity, to inform their staff of these types of attack in the same period.
Of course technical controls matter and the basics in our 2026 Cyber Essentials checklist are where every organisation should start. However, technical controls alone will not prevent someone who ‘tailgates’ your HR Director with the intent to steal sensitive data. In this post I set out the threats we train senior leaders to recognise and how our training day works.
The starting point is understanding why people and leaders in particular, are potential targets.
Why adversaries target your leadership
An adversary looks for the easiest route in to a business or system. Breaking strong technical controls takes time and skill. Persuading a busy executive to approve an urgent request from a “supplier” often takes neither.
The NPSA’s Think Before You Link guidance shows how people with access to sensitive technology, or senior leaders, can be linked through social engagements. The key is to identify who, in an organisation has access to sensitive information and data. Once identified, the challenge for an attacker is to obtain these individuals access credentials. Consequently, across defence contractors, PRIME’s, commercial organisations and the wider supply chain, the senior leadership team, who usually hold the widest access of anyone, can become a target for hostile approaches.
A technical security assessment, e.g. a penetration test or a Cyber Essentials Plus audit will test your devices and configurations. However, these types of assessment will not necessarily tell you whether your leadership team would be susceptible to any of the approaches below.
The threats we train leaders to spot
1. Tailgating
Government guidance on tailgating describes it as a technique for gaining unauthorised access to secure areas. Someone waits by a secure door, or struggles with a heavy box and asks for help. Others pose as maintenance or delivery staff (Never underestimate the power of the ‘High Vis Vest’ of authority!). Most people hold the door because refusing feels rude.
2. Covert filming and hostile reconnaissance
The NPSA describes hostile reconnaissance as the information gathering phase that comes before an attack. Its guidance also notes people who film staff and premises and post the footage online. A clear shot of a pass on a lanyard, or the shift change at the main entry point, tells an adversary more than most leaders realise.
3. Social engineering for passwords
The government defines social engineering as deliberately deceiving people into disclosing private information or granting system access. It may come as a call from “IT support” or an urgent message that appears to come from the chief executive. The NCSC notes that criminals use personal details from social media to make these approaches convincing.
4. Fake profiles and online approaches
Think Before You Link also warns about fake profiles offering attractive business opportunities. NPSA’s advice follows four steps: recognise the profile, realise the threat, report it to your security manager and remove it from your contacts.
5. Away from the workplace
This is the threat most organisations miss. A laptop open on a train or a phone call in a busy cafe can be overlooked or overheard. Sometimes that is an adversary deliberately collecting information. Just as often it is simple leakage with no malice behind it and the damage can be just as serious once the information is out.
Knowing these threats is the start. The harder part is changing what leaders do on an ordinary working day.
How our security awareness training for senior leaders works
We deliver the training in person, over half a day, at your site. Being in the room matters as it enables engagement and interaction in a manner that cannot be achieved via an online module and the discussion is where most of the learning happens.
The package is built around real world observations. We tailor it to each site and its senior leadership team, so the scenarios reflect locations, situations, and scenarios that the audience can truly relate to – that is what makes it so effective. Our consultants bring real military and commercial experience to these scenarios.
The aim is to give leaders a different view of their surroundings. “After receiving The Intelligence Advantage brief, you will see security differently. In fact, give us 4 hours of your time and we will change the way you view security for the rest of your life” Gareth Shaw, CEO Pera Prometheus
Training only changes behaviour when the wider organisation follows, which is where culture comes in.
Security culture starts at the top
The NPSA’s guidance on security culture is direct: “Effective security relies on people behaving in the right way.” It describes security as a collective responsibility shared by everyone in an organisation and in my view that shared responsibility is one of the strongest defences against insider threats.
I think leaders carry the most weight in making that real. When a director challenges a stranger in the corridor or reports a suspicious message, staff notice and follow. A clear, simple route for reporting concerns is often the most valuable outcome of the whole day.
The training day reinforces that habit. For organisations that want someone to maintain the momentum afterwards, ongoing support is the natural next step.
Read more: Is a Fractional Security Manager right for your Business
Conclusion
Technical controls protect your systems. Your people protect the information and your leaders decide how seriously everyone else takes that job. Information security awareness training, that starts with the leadership team, makes your people the first line of defence – turning a know vulnerability into an asset.
Changing how an organisation thinks about security is hard to do from the inside without awareness being raised. Our training and awareness programme is designed to instigate that change. It can be run at your site, specially tailored to your senior leadership team. Get in touch with Pera Prometheus to arrange it.
Frequently Asked Questions
Q: What does information security awareness training cover?
A: It teaches leaders to recognise threats that target people, such as tailgating, covert filming, social engineering and fake online profiles. It also covers unintentional leakage and how to report concerns.
Q: Who is the training aimed at?
A: Senior leadership teams. NPSA guidance identifies people with access to sensitive information as the high value targets.
Q: How is Pera Prometheus training delivered?
A: In person, over one day, at your site. We tailor the content to each site and its senior leadership team.
Q: What is tailgating and why does it matter?
A: Tailgating is when someone follows an authorised person through a secure door. One unchallenged entry can give access to people, equipment and information.
Q: Is information leakage always deliberate?
A: No, not always. Much of it comes from overheard conversations or screens seen in public places and the harm can be just as serious.
Stay Safe, Stay Secure
