Episode #8
Security leaders don’t need more headlines - they need inbox reality: what bypasses filters, what people click, and where to train next.
In this episode, host Eliot Baker sits down with Maxime Cartier, Hoxhunt’s Head of Human Risk Management, , to unpack the State of Phishing 2025: why SVG attachments spiked, what still works, how the Microsoft vs. Google stack changes the threat mix, and the training moves that actually change behavior.
What you’ll learn in this episode:
Why SVGs surged: “image-as-code,” how attackers weaponize it, and a typical kill chain.
What still works: PDFs/HTML + DocuSign, HR, and fake voicemail lures.
Inbox layer > filter layer: focus on what reaches people, not what got blocked.
Microsoft 365 vs. Google Workspace: different lure patterns, different coaching.
Metrics that matter: report rate and time-to-report vs. legacy completion stats.
“Report > Don’t Click”: building a high-signal reporting culture without blame.
Verification tactics: quick cross-channel checks that prevent costly clicks.
Program design: simulate what’s bypassing now and coach with instant feedback.
Timestamps:
(00:38) The Cost and Prevalence of Phishing in the Age of AI
(02:11) Good News in Cybersecurity Reports
(03:25) The Importance of Effective Security Training
(06:34) AI's Role in Scaling Phishing Attacks
(08:15) Deep Dive into AI-Generated Phishing
(13:37) AI in Personalized Spear Phishing
(16:52) The Threat of DeepFakes
(18:16) Real-World Examples of DeepFake Attacks
(25:00) Spotting DeepFakes: Tips and Tricks
(27:32) Phishing: The Dominant Threat
(28:51) Top Phishing Trends for 2025
(38:38) Industry-Specific Threats and Insights
(42:16) Innovative AI Solutions for Cybersecurity
Resources:
Host links:
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #7
Security leaders don’t need more slides - they need messages that move budgets, influence behavior, and reduce risk.
In this episode, host Eliot Baker sits down with CISO and author Jeffrey Brown to unpack a practical security communications playbook: metrics with a job, and how to build a report-button culture without blame.
What you’ll learn in this episode:
How to use Bottom Line Up-Front (BLUF) to get faster decisions from executives and the board - and when not to.
Turning “security talk” into business outcomes: mapping risk to revenue, resilience, and cost.
Metrics that matter: designing KPIs that show behavior change, not just completion rates.
Building a non-judgmental reporting culture (and why “Report > Don’t Click” works).
Instant feedback loops: faster reinforcement without punishment in phishing drills.
Story-first, stat-supported narratives that land across technical and non-technical audiences.
Practical cadences and mediums: what to send to execs, managers, and the whole org and how often.
Using analogies (brakes & airbags) to make layered defense memorable and actionable.
Timestamps:
Resources:
Host links:
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #6
“Trust the pause, not the voice.”
Voice clones and live-meeting deepfakes have collapsed the gap between “that would never happen here” and “finance just sent the wire.”
In this episode, host Eliot Baker sits down with Dr Jessica Barker MBE to discuss her book , 'Hacked' and to dissect two escalating threats - virtual kidnaps by voice clone and executive impersonation on Teams/Zoom.
What you’ll learn in this episode:
How virtual kidnapping scams use short audio to clone a loved one’s voice and what the attackers really want
Why emotions (panic, urgency, flattery) are the exploit, and how to train the “pause-verify” reflex
A breakdown of the fake-CFO-on-Teams play, and the checks that stop it
How to design culture as a control: empathy, non-judgmental reporting, and faster incident response
Story-first, stats-supported communication that changes behavior (not just awareness)
What to teach employees’ families about clone calls without fearmongering
Timestamps:
(00:00) Introduction and Welcome
(00:24) Dr. Jessica Barker's Background in Cybersecurity
(01:47) Receiving the MBE: An Honor in Cybersecurity
(03:44) The Importance of Storytelling in Cybersecurity
(06:37) Real-Life Cybersecurity Stories
(11:42) The Rise of AI and Deepfake Threats
(21:56) Combating Social Engineering Attacks
(26:53) Effective Communication in Cybersecurity
(33:40) Key Takeaways for Security Awareness Leaders
(36:47) Conclusion and Final Thoughts
Resources:
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Dr Jessica Barker: https://www.linkedin.com/in/jessica-barker/
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #5
“We have 100% completion… but nothing’s changed.”
It’s a complaint security leaders are making louder and more often. Completion rates are being called “cosmetic,” “misleading,” and “just optics” - metrics that check the compliance box but fail to reduce real human risk.
In this episode, host Eliot Baker sits down with Maxime Cartier, Head of Human Risk at Hoxhunt, to unpack what organizations are getting wrong about measurement and what the most mature programs are doing instead.
Drawing from Maxime’s recent insights at the SANS Security Awareness Summit, this conversation cuts through outdated KPIs and explores what actually signals behavioral change. You’ll hear what practitioners are building in the real world, how to bring leadership along without losing them in complexity, and how to measure success beyond tick-box numbers.
This isn’t theoretical - it’s tactical guidance from a field that’s evolving fast.
What you’ll learn in this episode:
Why 100% training completion doesn’t mean behavior has changed
How to spot “vanity metrics” and what to replace them with
Why security programs are borrowing measurement models from public health and road safety
What early signals suggest real change (even before risk metrics improve)
How to make behavioral metrics land with your board, not just your CISO
Timestamps:
(00:52) Maxime Cartier's Conference Insights
(02:16) The Problem with Training and Behavior Change
(03:40) The Misleading Nature of Completion Rates
(07:05) Advanced Metrics and Dashboards
(12:48) Behavioral Change and Public Health Parallels
(16:59) Early Indicators of Behavior Change
(19:39) Moving Beyond Compliance: Internal Buy-In
(35:43) The Power of Storytelling in Metrics
Resources:
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Maxime Cartier: https://www.linkedin.com/in/maximecartier
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #4
I might be transforming cybersecurity… but not always in the way vendors want you to believe.
In this episode, Eliot Baker sits down with Hoxhunt CTO and Co-founder Pyry Åvist to expose what’s actually happening at the front lines of the AI-powered phishing threat. No speculation. Just real research, real data, and real implications for your defense strategy.
Together, they unpack how Hoxhunt’s research team built and tested agentic AI spear phishing agents and what happened when those AI-generated attacks went head-to-head with elite human red teamers. The result? A 24% higher failure rate for AI phishing emails, across 50,000+ real-world simulations. This is more than just a stat. It’s a signal: AI threats are getting smarter, faster than most training programs can adapt.
This episode is both a behind-the-scenes look at the largest AI phishing benchmark ever run and a tactical guide for what to do next.
Here’s what you’ll learn in this episode:
Timestamps:
(00:38) Hoxhunt's AI-Powered Approach
(01:13) The Evolution of AI in Phishing
(02:21) AI's Dual Purpose: Good vs. Evil
(04:08) The Rising Cost of Phishing
(05:50) Human vs. AI in Phishing Attacks
(08:45) The Skynet Moment: AI Surpasses Humans
(16:15) The Future of AI in Phishing
(17:55) Conclusion and Final Thoughts
To get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter: https://hoxhunt.com/all-things-human-risk
Resources:
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Pyry Åvist: https://www.linkedin.com/in/pyryavist/
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #3
Should We Punish Employees for Security Mistakes?
Eliot is joined by Noora Ahmed-Moshe VP of Strategy & Operations, Hoxhunt) for a discussion on one of cybersecurity’s most divisive questions: should repeat offenders in training programs be punished... or is there a better way?
Leveraging on behavioral science, real-world case studies, and Noora’s global experience advising security leaders, this episode breaks down the flawed logic behind punitive training and surfaces more effective, scalable alternatives.
Here’s what you’ll learn in this episode:
Why punishment-based training strategies often backfire and how they can destroy psychological safety
How to understand the psychology of repeat clickers and uncover hidden motivations
What neuroscience and behavioral science say about fear vs. positive reinforcement in learning
How real organizations shifted from punitive to positive - and saw massive gains in threat reporting and engagement
Why individualized, adaptive training paths outperform one-size-fits-all models
What to do when even your best-designed training isn’t working for a small subset of users
The unintended consequences of using HR as a disciplinary tool in security awareness programs
How to counter the “optics of leniency” argument with data and outcomes
This isn’t about being soft. It’s about being strategic. If your goal is measurable, sustainable behavior change - this episode is essential listening.
Timestamps:
To get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter: https://hoxhunt.com/all-things-human-risk
Resources:
A short guide to effective security behavior change: https://hoxhunt.com/blog/cybersecurity-behavior-change
Qualcomm Case Study: https://hoxhunt.com/case-studies/how-qualcomm-used-targeted-security-awareness-training-for-employees
Guide to positive vs punitive approaches: https://hoxhunt.com/blog/punitive-vs-positive-cybersecurity-awareness-training
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Noora Ahmed-Moshe: https://fi.linkedin.com/in/noora-ahmed-moshe
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #2
RSA 2025 was full of AI claims - but what were security leaders really worried about?
Eliot is joined by Noora Ahmed-Moshe (VP of Strategy, Hoxhunt) for a no-spin debrief on RSA 2025. With AI hype at full volume and booth gimmicks ranging from goats to deepfake demos, it’s easy to miss the real signals in the noise. Eliot and Noora cut through the chaos to unpack what security leaders were actually focused on - and what it means for your strategy.
Drawing from hundreds of in-person conversations across the conference floor, they surface the real fears, needs, and shifts happening in the security community. This isn't a recap of vendor taglines - it's a pulse check on how defenders are thinking, what they're struggling with, and where the field is heading next.
Here’s what you’ll learn in this episode:
Timestamps:
(00:24) Overview of RSA 2025
(00:51) Hoxhunt Cyber News Roundup
(02:02) Verizon DBIR 2025 Insights
(03:12) Generative AI Risks and Third-Party Vulnerabilities
(03:52) NIST 2 Directive in the EU
(04:57) Experiences at RSA 2025
(05:48) The Human Element at RSA
(06:50) AI Dominates RSA Conversations
(09:04) Challenges and Themes in Cybersecurity
(12:44) Agentic AI and Its Implications
(15:13) Deepfakes and Vishing Concerns
(16:38) Omnichannel Phishing Threats
(17:21) Positive Conversations at RSA
(18:46) Surprising Trends and Insights
(27:04) Conclusion and Final Thoughts
To get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter: https://hoxhunt.com/all-things-human-risk
Resources:
Our research on AI phishing vs human red teams: https://hoxhunt.com/blog/ai-powered-phishing-vs-humans
Guide to deepfake phishing: https://hoxhunt.com/blog/deepfake-attacks
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Noora Ahmed-Moshe: https://linkedin.com/in/noora-ahmed-moshe
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.
Episode #1
Are your security awareness metrics actually measuring risk reduction? Or just checking boxes?
Eliot is joined by Maxime Cartier (Head of Human Risk, Hoxhunt) to break down what truly works it when it comes to reducing human cyber risk. Maxime has spent close to 10 years helping organizations elevate security awareness into human-centered risk management and led security culture initiatives for a major global retailer. In this episode, he shares the metrics that actually matter when evaluating your human defense layer and practical frameworks for quantifying risk reduction across your organization.
Here's what you'll learn in this episode:
Timestamps:
To get future episodes and the latest threats sent straight to your inbox, join the All Things Human Risk Management Newsletter: https://hoxhunt.com/all-things-human-risk
Resources:
Host links:
Eliot Baker: https://www.linkedin.com/in/eliotebaker/
Maxime Cartier: https://www.linkedin.com/in/maximecartier/
****
All Things Human Risk Management is a Hoxhunt Original Podcast.
Hoxhunt is the Human Risk Management platform that goes beyond security awareness to drive behavior change and measurably lower risk.
Data breaches start with people, so Hoxhunt does too. It combines AI and behavioral science to create individualized micro-training experiences people love.
Hoxhunt works with leading global companies such as Airbus, IGT, DocuSign, Nokia, AES, Avanade, and Kärcher and partners with leading global cybersecurity companies such as Microsoft and Deloitte.