Dr. Jason R.C. Nurse explores how our attitudes toward cybersecurity—shaped by personal experience, workplace culture, and even convenience—directly influence our day-to-day behaviors. This episode uncovers why making security feel approachable, not intimidating, may be the key to building a safer digital world.
Dr. Jason R.C. Nurse, Associate Professor in Cybersecurity at the University of Kent and Director of Science and Research at CybSafe, joins ITSPmagazine at RSAC 2025 to discuss how people’s attitudes shape their cybersecurity behaviors—at home, at work, and everywhere in between.
Drawing from a global survey of over 7,000 individuals, Dr. Nurse presents data that reveals a fundamental challenge: while many individuals recognize the importance of cybersecurity, a significant number also find it intimidating and frustrating. Nearly 43% of participants shared that they feel overwhelmed by security measures, highlighting a persistent disconnect between the intent of security protocols and the lived experience of users.
This disconnect manifests in inconsistent behaviors. At home, people may take extra precautions to protect their personal lives and families. At work, however, there’s a tendency to outsource responsibility to the employer. This duality—heightened vigilance in personal spaces and relaxed caution in professional environments—creates vulnerabilities in a world where attackers don’t care where the device or user happens to be.
The conversation emphasizes the need to rethink how we approach cybersecurity education, awareness, and design. Dr. Nurse advocates for a “usable security” model—systems that protect users without demanding overly technical knowledge or creating friction. He uses the example of biometrics and seamless phone authentication to show how good design can improve both security and user satisfaction.
To illustrate the connection between knowledge, attitude, and behavior, Dr. Nurse brings humor into the mix with a memorable analogy involving Kit Kats. Just as knowing something is delicious can shape our cravings and actions, understanding security in relatable terms can lead to more proactive behaviors.
The episode wraps with a candid reflection on trust and novelty in the face of emerging AI systems—like self-driving cars. Dr. Nurse questions whether people truly trust new technologies or if they’re simply seduced by convenience and innovation.
This is a conversation about what it really takes to build a security-conscious society—one that understands people as much as it understands threats.
Listen to the full episode to hear how mindset, usability, and cultural attitudes are reshaping the human side of cybersecurity.
___________
Guest:
Dr. Jason R.C. Nurse, Associate Professor in Cybersecurity at the University of Kent | https://www.linkedin.com/in/jasonrcnurse/
Hosts:
Sean Martin, Co-Founder at ITSPmagazine | Website: https://www.seanmartin.com
Marco Ciappelli, Co-Founder at ITSPmagazine | Website: https://www.marcociappelli.com
___________
Episode Sponsors
ThreatLocker: https://itspm.ag/threatlocker-r974
Akamai: https://itspm.ag/akamailbwc
BlackCloak: https://itspm.ag/itspbcweb
SandboxAQ: https://itspm.ag/sandboxaq-j2en
Archer: https://itspm.ag/rsaarchweb
Dropzone AI: https://itspm.ag/dropzoneai-641
ISACA: https://itspm.ag/isaca-96808
ObjectFirst: https://itspm.ag/object-first-2gjl
Edera: https://itspm.ag/edera-434868
___________
Resources
Learn more and catch more stories from RSA Conference 2025 coverage: https://www.itspmagazine.com/rsa-conference-usa-2025-rsac-san-francisco-usa-cybersecurity-event-infosec-conference-coverage
Catch all of our event coverage: https://www.itspmagazine.com/technology-and-cybersecurity-conference-coverage
Want to tell your Brand Story Briefing as part of our event coverage? Learn More 👉 https://itspm.ag/evtcovbrf
Want Sean and Marco to be part of your event or conference? Let Us Know 👉 https://www.itspmagazine.com/contact-us
___________
KEYWORDS
sean martin, marco ciappelli, jason r c nurse, rsac 2025, cybersecurity, behavior, mindset, usability, ai, trust, event coverage, on location, conference
Mindset Matters: Rethinking How We Teach and Design Cybersecurity | An RSAC Conference 2025 Conversation with Jason R.C. Nurse | On Location Coverage with Sean Martin and Marco Ciappelli
Please note that this transcript was created using AI technology and may contain inaccuracies or deviations from the original audio file. The transcript is provided for informational purposes only and should not be relied upon as a substitute for the original recording, as errors may exist. At this time, we provide it “as it is,” and we hope it can be helpful for our audience.
_________________________________________
[00:00:00]
Sean Martin: Marco. Sean, you ready to roll?
Marco Ciappelli: I am always ready to roll. You got the couch and I feel very important because I'm in the king, this chair. That's right. Oh, nice. I'm in the king chair.
Sean Martin: That's right. I had the king chair earlier. I know. It's a nice chair.
Marco Ciappelli: I was jealous. Did
Sean Martin: you have the, you have the arm rest. I was jealous.
So I wanted to have it. I
Marco Ciappelli: feel much more important. Serious. If you were nice, you would've given our, our lovely guests. The king. You can, you can put it on each other. You're half king. Yeah,
Sean Martin: maybe.
Marco Ciappelli: Oh man. Uh, again. RSA conference. Right. 2025. We are very excited to be here. It feels like we've been on this conference for a month because we do a lot of pre-event conversations, but now we're here for real.
I know. Yeah. In person. Yeah, yeah, yeah. With a good friend. Yeah. That we, I don't know how many podcasts we've done together. At least two. At least two together. Yeah.
Sean Martin: Yeah, yeah. Yeah. We met through our good friend Julie Haney. Yeah. From this. Yeah, yeah, yeah. Shout out to Julie. Yeah, indeed. We did
Marco Ciappelli: all the way from the uk.
Jason R.C. Nurse: Yes, it was [00:01:00] Jason. A long flight here.
Marco Ciappelli: No entertainment I heard. Yeah. Unfortunately you were the entertainment I heard. Yeah, there was no entertainment on the flight.
Jason R.C. Nurse: Which, which when it, when it's an 11 hour flight, it's twice as long when there's nothing to watch.
Marco Ciappelli: But you had a lot to think about the event.
Jason R.C. Nurse: A lot to think about, a lot to plan for. I'm the sort of person that I had my schedule decked out before I arrived, so yeah, really excited. Really,
Sean Martin: really excited.
Marco Ciappelli: Very good.
Sean Martin: And uh, so maybe not. Or unless you want to, but did you come up with the, the memorable thing on the flight? Or how did it, or was that already baked into?
Jason R.C. Nurse: Um, it's probably already baked in. Okay. Um, like one thing, to be honest, I was probably the most surprised by is how early I need to submit, um, slides. Ah, okay. Uh, for, for our essay, I mean, it was, it's, they've been done for a while and ready to go. So it's really just a case of getting ready to prepare them and present them.
Marco Ciappelli: Mm-hmm. Very good. Well, let's start from the beginning.
Jason R.C. Nurse: Yeah. Yes. Yeah, let's do that.
Marco Ciappelli: Who are you? Why are you [00:02:00] here? Right. So in simple
Jason R.C. Nurse: terms, uh, my name is Dr. Jason Nurse. Um, I do research in, in cybersecurity, especially looking at the human aspect of cybersecurity. That's my specialist, that's my research area.
Uh, I'm part academic and I also, um, work in an a tech startup as well. Um, and I'm here at our SA to deliver a talk specifically on. Um, understanding people's security attitudes and behaviors. So basically, why do people think what they think about security? Why do people behave, how they behave and how do attitudes, so how people think about security actually impacts their day-to-day behavior.
Marco Ciappelli: And this is for people in the work environment? Yeah. Or you also thinking about society at life. So it's both actually.
Jason R.C. Nurse: Um, and it's really good because it allows us to explore people's personal lives and how people think and are behaving with security at home. But then also, you know, people work lives and how are they thinking and behaving about security in work?
So it covers both of them. It's really exciting Study.
Sean Martin: Does, does the attitude change?
Jason R.C. Nurse: Uh, it does [00:03:00] change a bit. Actually. Worldly enough, it does change. Um, at home. People very much care about their personal lives, their families at work. What's really interesting is that sometimes people sort of almost think that they can leave the security to their employer.
Um, and that's even one of the most interesting dynamics that came out of the research. Yeah,
Marco Ciappelli: I was actually reading something about that and, uh, and having a couple of chats. 'cause you know, that's the reason why we talk, because it's the human aspect of cybersecurity. Yep. Which is more my, uh, cup of tea and, uh, like when people are so obsessed and, uh, and, and regulated mm-hmm.
By, you know, being cyber secure, being told what to do or work mm-hmm. Then they go home and they're like, ah, I don't have to worry about that anymore. Yeah. And that's the problem.
Jason R.C. Nurse: Yeah. Yeah. Yeah. It's a really interesting dynamic because, and different people approach security in really different ways in that some people will think like that and some people will think, okay, the security's done.
I'm at home now. I can just chill out, like, chill up my family. [00:04:00] But unfortunately, cyber criminals don't think like that. Uh, and they are really keen to jump on and punks on any opportunity that arises whether someone is at work or whether someone's at home.
Marco Ciappelli: Yep. Yeah, yeah,
Sean Martin: yeah. And we, uh, we've had many conversations on this topic in terms of, uh, the secure environment at home, because many times devices that are owned by the business are at home, or devices that are owned by the individual are used at work or vice versa.
And family members jump on and access social media and other, other applications, which it all. Gets intertwined. So the mindset and the, and the, the desire to be secure kind of needs to be the same across the board, I think
Jason R.C. Nurse: in an ideal world, yes. Um, and I think, to be honest, what really changed things and really brought things home is the covid period where, you know, it's not a period that we, we often like to talk about too much, but because [00:05:00] everyone was working out from at home because people had, um, basically to use.
Sometimes home technology for work or definitely work technology at home. It created this sort of really new, um, way of how people sort of approach work and thought about work in the context of, well, yeah, I can work a bit and then I can do other stuff. But then even when you think of people's work devices, all of a sudden people started to use their, per their work devices to watch Netflix, to download stuff, to shop, to go to certain websites, and.
I think it's an interesting demo. Um, it's an interesting reality in terms of how that played out and now the relationship that people have with personal technology and actually work technology as well.
Marco Ciappelli: Yeah,
Jason R.C. Nurse: yeah.
Marco Ciappelli: Well that, that's why the more and more we say cybersecurity is a mindset where our culture, where you embrace it, then you realize it, that there's not on and off.
You just need to be cautious all the time. Yeah.
Jason R.C. Nurse: Yeah. And it's unfortunate because it is. It is the name of the game now. [00:06:00] Um, as I mentioned, attackers are opportunistic. They wanna get us wherever they can get us, um, regardless of where we are. So, you know, even in the context of that research, um, it was really about trying to understand how people think about security, um, from the perspective that it is very much a mindset.
It is very much a how people think about security, influence how they behave. Mm-hmm. But then the reality is that, and this is one thing that I think is really, really important, that sometimes we as a security community, we gloss over in that. Um, understanding people's behavior is, you know, there's a lot of research in terms of psychology and behavioral science that we can draw on in security to better understand that mindset and better understand people's behavior, and then use that to hopefully make things better in the context of security
Sean Martin: for individuals.
So, I'm glad you went there because I mean, it, it's one thing to look at how many attack in a sock, let's say, how many attacks were attempted. How many were successful? What was the lateral movement beyond that? Yeah. How quickly did he respond? How quickly did we, there's a lot of stuff we [00:07:00] can measure and analyze.
When you start talking about the human mind and how people think and how they respond to actions that they, that they encounter, or things that are thrown their way, it's, it's a little less, at least for me, it's a little less obvious. Yeah, it seems a little more fuzzy. So talk to us a little bit about the research.
And how, how you look at behavior and how you look at mindset and what do you, how, how can you measure that to determine what do we do in response to how people think and function?
Jason R.C. Nurse: Yeah, it's a great question. So in the context of this research, we, we did it, I mean, in the context of all research, you can measure it in very, very different ways.
Uh, in the context of this research, what we essentially did was we relied on a self-report study. So we developed a set of kind of key questions to better understand. How people perceive security and how people think about security, people's attitudes, people's beliefs. Um, and then we basically, we took that and we also asked questions, once again, questions to individuals directly about what are they behaving in [00:08:00] a day-to-day basis.
And we basically took these, um, we did this, this, this research actually surveyed over 7,000 people across the globe. Uh, what was really interesting about this research this year as well is that we got the five i's, uh, which for us is always something we wanted to do. We wanted to get that sort of global representation.
Um, so we answered people these questions and we got a load of interesting data that really pointed to and helped us understand to what extent do people view security as a priority to what people, to what extent do people think that security is actually possible, like day-to-day security is possible?
And what we found were things like, well, the average individual, um, actually about, I think about 40% or 43% of individuals, they, yeah, they think security is great, but they find security extremely intimidating.
Sean Martin: Mm-hmm.
Jason R.C. Nurse: They find security extremely frustrating. Uh, and I think for, for me, that's a really interesting one because it helps point to the fact that when we say people aren't motivated or people aren't acting as we want, as it relates to security, well, the reality is that deep down people actually think security is really, really difficult.
And it's really, really [00:09:00] tricky and it's really, really challenging. Uh, and sometimes in the security space we, we potentially use terms that are a bit too opaque for the average individual, and that doesn't help with this bridging this gap. And it doesn't help make people. Want to be more aware about security or security practices and actually put those good practices in place.
Marco Ciappelli: Yeah. So how does a Kit Kat come into play
Jason R.C. Nurse: a Kit Kat? Yeah, great question. Bring the food in. Yeah. I mean, kit Kat amazing. Um, I think what what was really interesting, so I did rid my talk. It went along really, really well. Um, actually was, was super exciting to see that many people in the room. Um, so I was trying to explain and 'cause I think it's really important to always have a mid ground between myself, uh, and the audience.
And, um, there was this one side in particular where we're trying to help people understand the fact that, um, knowledge about something can infa impact people. What people's attitudes are towards something and then that can impact people's behavior.
Sean Martin: Mm-hmm.
Jason R.C. Nurse: So the example I chose to use that I thought would resonate with the audience quite well is Kit Kats.
Marco Ciappelli: And it did. Right? And, and it did. [00:10:00] And it did, right.
Jason R.C. Nurse: So, kit Kats, uh, I love a Kit Kat and you know, I know that Kit Kats are delicious. Uh, that influences my attitude towards Kit Kats. Okay. They're delicious. Mm-hmm. I want them, uh, you know, I want to get, if I see one, you know, gimme a Kit Kat. And then, and then of course that behavior such that, well, if I see a Kit Kat or if I see a Kit Kat stand or something like that, well, yeah, I'm gonna go and grab a Kit Kat.
And so knowledge can impact people's attitudes, and attitudes can impact behavior. And that was the example I, I chose, uh, to give in the talk. And what was I thought was really interesting is that as I was walking over here, actually, um. Uh, through a really, really crowded, you know, who RSA is super crowded.
Uh, I'm just trying to make my way through a sea of people. This person comes up to me and he's like, Hey, you're Jason, the Kit Kap guy. Uh, and I was like, whoa. Uh, I was like, okay, yeah, yeah, that's, that's me. And he's like, love your talk. And he just continued walking and I thought, wow, okay. You know what? It resonated with him.
Uh, and you know, that's important. Yes. Because that resignation is important. I'm hoping that [00:11:00] he took away this stuff from the top. But you know that resignation is, is important and that's okay. Kas coming into play. So
Marco Ciappelli: is your point to say we need to make cybersecurity cooler more delicious, more as of an enjoyable,
Jason R.C. Nurse: we need to practice?
Yep. I think we need to understand one, why people find it frustrating and intimidating and we need to help bridge that gap. And it could be a case of yes, making it more delicious for the average person. There's certainly an argument for that. More fun. Um, but also there's an argument that, and this is another one I think is actually particularly important.
We need to always ensure that technology gets better, such that it takes away some of those really difficult choices for individuals. Like, like one thing I really loved, uh, and I do a lot of research in the context of usable security, and one thing I really loved was, um, and I want to continue to love is biometrics when we think about face ID and stuff like this.
Mm-hmm. And when we think about, well logging into. Your mobile phone or, or you know, put in a 10, you know, [00:12:00] a 10 digit pin. It's not, not usable. Right. Someone doesn't, so they'll just ignore pins. But now, you know, we thankfully, at least with mobile phones, we've reached a point where you just take up your phone, have a look, it authenticates who automatically, and it logs you in.
So technology has gone to the point they watch and
Sean Martin: even, even have to look. Yeah, exactly. Exactly right. So as soon as you lift it, it's
Jason R.C. Nurse: Exactly. So technology has gotten to the point where. It's extremely usable and, and it still has that good level of security, and I think all security session needs to be like that.
So it isn't a blocker, it isn't a hindrance, it doesn't cause issues, it doesn't make people frustrated. Mm-hmm. But it works. And it works well, and it's still secure.
Sean Martin: Right. So the, the, the, the process and the workflow is not interrupted. Yep. Um, and the, the, the security aspects of it are almost hidden. Yep.
Um, yeah, this, I don't know, it was probably 25 years ago I looked at some of this stuff and one of the research, the research we're doing then for us usability was around [00:13:00] hiding it, but showing it when it was necessary. Yes. That's the truth. So talk, talk to me about that. When, when do you want to share something and maybe even about the language, 'cause you touched on it earlier.
Yeah. What, what do we say or what do we show? When we want to display something.
Jason R.C. Nurse: Yeah, great question. Um, and I think for me, so probably about 10 years or so ago, I did a good amount of research on cybersecurity risk, um, communication. I hope to communicate risk. Uh, and I think this was really interesting for a number of reasons, but to your point, one analogy I would like to point, and that's a really great example to this, is, um, the padlock in browsers, right?
Right. So we all were familiar with the padlock and padlock emerge, and everyone got to know that the padlock is. Is, that's how you, that's how you show a website for many people. The whole website is secure. Doesn't exactly mean that. But let's, let's play along, right? Let's, let's play along. Let's play along.
Um, and, and that detail was shown because it was viewed as important. So people, the padlock, 'cause that detail [00:14:00] was important. And if you wanted to find out more, you can click on the padlock and you could see certificate information, right? Average person doesn't care, doesn't need to know. And what have browsers done Now, generally speaking, browsers don't have the padlock anymore because that detail.
Isn't viewed as important to show anymore. Right. And I think, yes, you can still click and you, there's another button you can press and you can see certificate information. But I think now the key thing and, and that's where it's really, really interesting in that yes, we have to, as much as possible, make security easier.
Make security more usable. But for those people that want to know more, they should have the option of drilling down. They should have the option of getting that detail. Someone that wants to know, Hey, is this website secure? What's going on? Right? Can I see certificate information? They can get that.
Sean Martin: So I think early on with the, with the padlock and some of the other stuff I was talking about, the, the challenge was security was added Mm.
And not [00:15:00] part of Yep. Um, and I think we still see a lot of that. You, you have systems and applications and then security teams come in and try to. They, they, they add the authentication and the access control, and they add the monitoring and the alerting and the blocking and all that stuff on top of it.
Yeah. Um, does, does your research uncover anything there that we as an industry and as developers of technology beyond security need to consider? I
Jason R.C. Nurse: think probably the one that resonates the most right now is just security around AI system. I mean, I don't think I could have probably done this talk without, um, mentioning AI or generative AI in some way.
We go, we're done. I apologize. I apologize. You said ai, I apologize. Um, but the reality is that, um, as it relates to AI systems, as it relates to how AI is used and the security of it is more and more important simply because of how much is embedded in almost everything that we're doing. I mean, we are, we are in San Francisco, uh, amazing.
Um, one of the two things that resonated with me most since I've actually been here. Is it [00:16:00] driverless cars? There you go. Right. I mean, like, it, it has been incredible. Like, you know, it is just, there was, I think it was one point in time where I was walking down the street and I saw this car passing and I just had a glance to my left.
'cause the car looked a bit different. I didn't really know what it was. I looked in the front seat and there was no one, and the car was moving and I was,
Sean Martin: yeah. What's And another one here and then comes another and then comes another. Yeah,
Jason R.C. Nurse: yeah, yeah. There. There're quite a few of them. Right. Um, and you know, for me, when we think about this and um, in terms of security and, and ai, it's just.
It's just so important because now we have these systems that are driving cars. Um, and for me it's really important in terms of security because they're driving cars, which means that they're responsible for devices, um, technology that could, uh, potentially significantly harm individuals. Yeah, right. So I think that for me is why becoming more important and the average person, you know, has access to more AI than probably many people have had in the last 10 years.
So. Uh, I'm gonna
Marco Ciappelli: [00:17:00] follow with that. Yeah. Because I've been driving around Yeah. San Francisco. So dealing with very polite, self-driving cars. Yeah. A lot more polite than Italian driving. And uh, and I saw many different kind of people actually getting in the car. I saw a family with a really small child.
Mm-hmm. It means they really trust the car.
Sean Martin: Yeah,
Marco Ciappelli: yeah, yeah. Right. So the question for me. To you and it's the last one. 'cause we're running out is
Sean Martin: Yeah.
Marco Ciappelli: Yeah. How do you know if people are trusting or they just gave up? Uh, I
Jason R.C. Nurse: mean that's probably, yeah, that's an interesting one for a last question, I think.
Yeah, go for it. I think personally that, um, people are trusting to some extent, uh, personally for me, I think that there's a fair amount of novelty. Um, there's a fair amount of novelty in it. Mm-hmm. And that people will try this stuff out because, hey, I can, I can film this, I can talk to my friends about it.
Mm-hmm. I can. Um, but I think trust, trust is a big one. Um, and for me, sometimes I've [00:18:00] found, especially based on my research, that sometimes people are willing to give up a bit of trust for novelty, um, for using that new thing to be using that new product, using that new device. For me, especially these days where, you know, the, the reality is that, you know, we are all very open to shouting about stuff as much as possible, especially if it may, maybe even the thing that we should shout about.
So it, it's tricky. Um. I'd love to see how, you know, I, I hopefully will see how driverless cars, uh, continue to, to take over maybe the US and maybe the world. But, you know, Lexi, but really great question. Yeah.
Sean Martin: Yeah. LA last year I got to drive one. Our good friend LA um, booked a car and I got to drive and it was, it was quite incredible.
There were little nuances that, that the car, the car would do something that a human wouldn't. Yeah. 'cause it was so precise. Yeah. Mm-hmm. Um, and I think the interesting thing for me was the. I felt safe because I wasn't at speed and I was inside the car.
Jason R.C. Nurse: Can I [00:19:00] make one, one last point. Yes. One last point.
One last point. Um, so, uh, two instances yesterday that, um, as I was walking around that I found actually super interesting. So I love technology. I'm a technology person, so I a hundred percent would try them. Um, however, I was walking to a crossing and one was coming on an alley, and even though I would get in it, I would, yeah, I'd definitely try it.
I got to the crossing and I was, and literally I hesitated 'cause I was, I was thinking to myself, Hey, do I want to walk in front of this because Will, will it stop at the crossing or not? Mm-hmm. I don't know. Mm-hmm. So I walked very tentatively towards it and then it slowed down. But it was interesting for me, you know, as a sort of almost social experiment because I would get into it, but here I am now, not wanting to walk in front of it.
And then lastly, just really, really quick, um, once again, yesterday I was watching, um, one of the driver's cars that was turning right at a junction. And um, there was this person walking in front and they were on the crossing. So they were on the crossing, walking, the driverless car was waiting for them to finish [00:20:00] cross to turn right.
They stopped and they jumped back. And that made the driverless car immediately stand brakes. And what did they do? They just looked at and laughed. 'cause they did it on intentionally. Mm-hmm. And they just continued walking. So once again, it's how people engage with new technologies, the perception of new technologies.
So I think, you know, we're gonna see all of that playing out in the next couple years, and
Marco Ciappelli: yet I wonder if somebody's actually gonna stop and is not distracted by watching their phone or drinking their coffee. And I don't know if I want to trust the car driverless even more, but we're gonna leave it at that.
Yeah, we're gonna go drive a car with a Kit Kat. Yeah. Yeah, you should do that. And we're gonna have a good time. Yeah.
Jason R.C. Nurse: Sounds good. Sounds good to me.
Marco Ciappelli: All. This is the end for this conversation. We'll have many more. Of course we do. Uh, and many more right here. RSA Conference 2025. Yes, thank you. Showing you're up for more
Sean Martin: ITP magazine.com/ RA 25 for all of our coverage.
Thanks everybody. We'll see you soon. Take care.