If you were to write a children’s book on digital safety based on time-honoured advice, what would be the most important moral lessons it contained? According to Anna Collard, SVP of content strategy and CISO advisor for KnowBe4 Africa, modern cyber threats should be reframed through the lens of the physical safety lessons we learned as children to build stronger cognitive resilience.
While cybersecurity is often framed as a high-tech arms race of code and encryption, its greatest vulnerability remains stubbornly analogue: the human brain. “To build true resilience, we have to acknowledge that our biological hardware simply hasn’t kept pace with our digital software,” Collard says.
The biological disconnect and wolves in sheep’s clothing
In the physical world, a threat is visceral. Collard points out that if an individual walks down a dark alley and encounters an intimidating stranger, their sympathetic nervous system triggers an immediate threat response. The heart rate increases, pupils dilate, and the amygdala – the brain’s ancient alarm system – screams for caution.
In the physical world, we understand this “fight or flight” response. Collard points out that while we think we are evolved, our nervous system cannot always differentiate between a physical predator and a digital one. When an email creates a sense of extreme urgency or social pressure, the brain reacts instinctively. The heart rate climbs, and the amygdala, the brain’s ancient alarm system takes over, effectively hijacking the prefrontal cortex where our critical thinking resides.
“A phishing email is far more than mere pixels on a flat screen – it is a sensory trap designed to trigger a stress response,” Collard explains. “When we see an ‘Urgent’ subject line or a ‘Security Breach’ alert, our nervous system treats it as a proximity threat. The stress response circumvents our logic, meaning we react before we’ve even had a chance to think.”
This is compounded by one of our built-in cognitive biases: trust-bias, which is to first trust before questioning.
“We have forgotten the lesson of the oldest fairytales,” she says. “In Little Red Riding Hood, the wolf didn’t need to look like a monster to be a threat; he just needed to sound like a concerned grandmother to bypass her defences. In the digital age, the most dangerous wolves look like helpful IT support or a boss in a hurry.”
This is compounded by the “online disinhibition effect”. Collard notes that without eye contact or physical proximity, internal brakes are softened. “We share information with a stranger in a LinkedIn message or a WhatsApp group that we would never dream of handing over to a person standing in front of us in an ATM queue,” she says. “We have forgotten one of the first rules the old fairytales like Little Red Riding Hood taught many of us: the most dangerous wolves can sometimes look like helpful strangers.”
The Three Little Pigs and the “security illusion”
The tale of the Three Little Pigs offers an apt parallel to modern corporate vulnerability – the first two pigs essentially got eaten because they suffered from optimism bias. They built houses of straw and sticks because it was faster and easier, assuming the wolf was a distant, theoretical problem.
In modern organisations, employees often live in straw houses built of weak passwords and neglected multi-factor authentication (MFA). Collard attributes this to a sort of security illusion – the false belief that bad things only happen to other people.
“During a busy workday, we rely on System One thinking – the fast, instinctive part of the brain,” she says. “”We can’t, and shouldn’t apply System 2 or slow analysis to every email; it’s simply too inefficient,” she explains. “Instead, we must move from a straw-house mentality to brick-and-mortar resilience by sharpening our subconscious ‘tripwires.’ The goal is to remain in our fast, instinctive flow until a red flag appears, like a delivery service asking for a password, at which point we instinctively pivot to the slower, analytical thinking required to catch a scam.”
Rumpelstiltskin and digital mindfulness
The legend of Rumpelstiltskin teaches that naming a threat gives one power over it. In cyber-psychology, this is known as “emotional labelling,” and Collard views it as a vital diagnostic tool for employees.
Social engineering works by hijacking the amygdala, using urgency, fear, or greed to bypass logic. Collard suggests that many high-stakes frontline industries where employees face physical hazards or danger have relied on training and systems that are resilient even when employees face direct threats and emotional responses. “When a pilot faces a mechanical failure during a flight, they don’t panic like the rest of us in economy class,” Collard states. “The reason they don’t is because they know they can rely on their training and the systems that support them. It is that foundation that allows them to fend off emotional overwhelm and re-engage the prefrontal cortex for analytical responses to their environments, even when things have gone awry.”
In the office, this works exactly the same way, Collard explains. “Taking five seconds to say, ‘I am feeling pressurised by this email,’ reduces the power of the primitive brain,” she comments. “It allows the analytical brain to take back the wheel. Suddenly, the employee isn’t a victim reacting to a crisis, but rather an observer noticing a suspicious URL others might have missed.”
Building a resilient security culture
When it comes to securing the digital workforce, Collard maintains that simplifying cybersecurity into messaging that leverages principles pioneered by age-old maxims helps us better understand threats.
“When security is framed through familiar metaphors, for instance, it moves from being a set of abstract rules to a set of instincts,” she asserts.
By reconnecting with natural threat-detection instincts and applying analogue wisdom to digital spaces, Collard believes organisations can create a “neighbourhood watch” culture. “We don’t necessarily need more complex manuals; we need to remember the old-school wisdom that has kept us safe for generations: lock your doors, don’t trust ‘free’ gifts, and if a deal sounds too good to be true, it almost certainly is.”
