Speaking the same language as your audience is important. In most cases you're already speaking the literal, high-level language of your audience but it's a lot more nuanced than that. Language at a lower level is one thing that trips people up on the way to understanding. Jargon, acronyms, slang, and cultural quirks can all act as barriers to mutual understanding - which is the whole reason we communicate. These are so ingrained in us, however, that it takes effort to suppre

There are a lot of ways to think about audiences of information security messages. Your relationship to your audience influences how you communicate with them. Why are they listening to you? Are you part of an internal team - are you communicating with your coworkers - or are you an external entity - a contractor/consultant? Is your audience internal or external - are they employees of the company or are they customers/clients/end-users/etc.? Let's look at the pros and cons o

Last post, I went over two methods for understanding or segmenting your audience. The first was based on the influence you have over your audience - why are they listening to you in the first place? Affinity Required to listen Structural reasons Check box Someone else told them they had to Fear Legitimate interest Based on these, here are some scenarios and how to tailor your communication to that audience: Scenario 1: A (work) friend asks how they can be more secure (affinit

It’s commonly known that we (humans) are bad a evaluating risk. We're consumed by worry about risks that are unlikely to impact us and disregard risks that are more likely. People are afraid of flying and worried about terrorist attacks but don’t think twice about getting in their cars or putting off annual check-ups. There’s a lot of research and writing about why humans are bad at risk assessment. Two things that drive our poor risk perception are: 1) being bad with percent