American View: Closing the door on forgettable security training

Risk Management09 Dec 2025

There’s an adage in the human risk profession that deftly explains why I’m in so much physical pain today: you can be taught a security rule, but you won’t reliably follow that rule until you’ve suffered the consequences of ignoring it. While it’s not quite as catchy as loose lips sink ships, it’s a still a fundamental axiom in our profession. Us human risk practitioners invest thousands of hours crafting clever, catchy, and comprehensive training content for our users, only to relentlessly see our users ignoring what we’ve told them and getting into easily avoided trouble.

Part of this comes from limited attention spans; the corpo world is drowning workers with mandatory “training,” most of which either doesn’t apply to the majority of workers or is so tangential to their work that it’s easy to dismiss. The most important material gets lost amidst the noise.

Another part comes from how shallow most training content is. Bosses constantly demand that mandatory courses be made as short as possible to free up workers’ time up for “real” work. When you’re only allowed to spend ~15-30 seconds on a complicated topic, it’s hard to make a message stick – even a crucial warning.

Finally, without compelling emotional hooks, most training content gets misperceived as abstract and academic. Yes, malware is bad. We get that. We’ll remember it for the end-of-course quiz … but we won’t internalize the message. It’s a paper problem; something to be dumped like last semester’s English Lit trivia once the course is over.

The inevitable result is accidents, errors, and omissions. Good people doing things they were told not to do, and agreed not to do, but rationalized doing anyway because the risk they accepted didn’t feel “real.” I know this. I teach this to new practitioners. I wholeheartedly believe this … and I’m just as prone to falling victim to it as everyone else.

"Yea, boss. He got tripped up by his convoluted sentence structure and the whole paragraph collapsed in a jumble of incomprehensible jargon.”

As an example, I idiotically fouled up this last week by making an obvious, preventable, and inexcusable mistake while working on some hardware Thursday night. I have no excuse: I knew better and still rationalized away taking the situation’s necessary cautionary measures because I minimized the potential risk I’d accepted … Ugh.

Here’s what happened … and yes, you’re allowed to laugh at me for it.

On Wednesday night, my youngest and his mate were running errands on the far North edge of our city. The infrastructure up there hasn’t yet caught up to urban standards, like stoplights. My kid was waiting at an unprotected stop where a one-lane service road intersected a busy two-lane road with a high speed limit. A large delivery truck was first in line to turn. Its driver was being responsible, probably because they knew they couldn’t accelerate fast enough to take advantage of the very short gaps in cross traffic. With no stoplight, this meant the other drivers behind the truck grew impatient.

One such driver — a teenager in a big Ford SUV — decided to do something illegal, unwise, and potentially suicidal. He pulled out of the queue, stomped on the gas, and tried to pass the stopped truck on the in-bound lane. This meant that the adventurous young driver couldn’t see the oncoming traffic in his blind spot for 3-4 seconds … not until he cleared the stopped delivery truck and ventured boldly into no-trucks-land.

Do I need to say it? OF COURSE there was a car zipping straight at the young doofus which had the right-of-way. The oncoming Jeep had no time to react before it rammed the Ford on its left-front quarter and pushed the SUV’s engine up into its glove compartment. The Ford spun while the Jeep — remarkably still intact! — veered off the road and careened into a barbed wire fence. Fortunately, the well-built fence forced the Jeep to stop … mere inches from a natural gas pipeline.

My kid pulled over and got out to triage the wounded, call an ambulance, and clear debris. So did a bunch of other folks, which makes me darned proud of our community. They stuck around until the firefighters took control of the scene and dismissed the good Samaritans. That no one was killed was amazing. In fact, no one was seriously hurt! Nonetheless, the Ford was totalled and the Jeep might have been. My kid talked to both drivers and offered up his dashcam footage if they needed it for their insurance companies (again, so did two other drivers). That’s why my kid called me after work and asked for help getting the digital footage off his camera.

His dashcam was one of these cylindrical jobbies that mounts in front of the mirror and is a pain to get to.

I should explain that my kid needed help with this task because the dashcam had been installed by the dealership he bought his truck from. It was one of those overpriced perqs that dealers add on to a car after it leaves the factory to boost their profit margin, like racing stripes and “invisible rustproofing” spray. Since my kid hadn’t selected or installed the dashcam, he hadn’t yet learned how to use it. Never needed to.

He dropped by the house the next day after work, parking on the street so that his mother could have the driveway. I got in his driver’s seat and examined the dashcam where it was mounted just below the mirror. Feeling around the housing, I found a familiar feeling perturbance and called my kid over. He opened the passenger side door to get a closer look as I used a fingernail to push in the micro-SD memory card.

Normally, in the sort of devices I use, SD card slots only push their cards about halfway out of their slot. That is, they don’t “eject” their cards completely. This dashcam was not that courteous. As soon as I moved my fingernail out of the card’s eject path, it rocketed out of its slot like a squirrel on meth. It literally shot out of the camera like a rock out of a slingshot, arcing past my son’s shocked face and soaring away into the street. Neither of us had the presence of mind or the ninja-like reflexes to intercept the little bastard before it disappeared.

Now, losing a cheap memory card isn’t a big deal. It’s embarrassing, but the cost of a replacement card is only a few dollars. The crash footage on the car, though, could be worth tens of thousands of dollars to oner or both of the two drivers from the accident if my kid’s footage helped the affected drivers’ insurance carriers establish fiscal responsibility. So, we got to searching.

You’d think this would be quick and easy. Find a small grey plastic square on a dark asphalt road? Except … no. First, the danged SD card had been traveling fast enough bounce another 3+meters when it hit the ground and could have veered, skipped, or ricocheted in any direction. Second, it’s still Autumn in North Texas. Dead leaves pile up in the gutters and cover the streets down here until we get a really strong winter rainstorm. Also, unlike y’all, we have really wide residential streets. Kinda have to when every other homeowner on your block owns a pickup truck that could double as a luxury apartment.

These monsters are as common as blue jeans out thisaway. Throw some sleeping bags in the cargo bed and six adults can sleep stretched out and comfy in these things.

My kid and I tore the inside of his truck apart, pulling up floor mats and coming through every seat cushion and map pocket, just in case the memory card had bounced back inside. We even checked the treads on his tyres. Then we slowed combed the street, scanning centimetre by centimetre, multiple times until it got too dark to see. Then we came back and ran the pattern searches all over again with flashlights. No joy.

For the next two days, I’d come out for two-hour shifts expanding the area of our original search. I eventually reached the point of meticulously hand sorting and combing through all the leaves, acorns, and debris in the gutters to make sure the stupid little plastic memory card wasn’t hidden. Things got so silly that three different neighbours sidled over to ask me (a) why I was inspecting their tree debris and (b) had I remembered to take my meds? I explained myself and got some big laughs … even a little help. I offered the neighbourhood kids a cash reward if they found my bloody memory card. Some helped out. Still no luck.

What kills me is that I bloody well should have known better. When working on equipment outdoors, you always minimize the area that parts can drop into. Whether that means putting up barriers or moving inside or just shutting the bloody doors, you don’t want to create any conditions that might allow very small parts to disappear into the environment. I knew that rule from Army vehicle maintenance … and I ignored it. I rationalized that showing my kid how to find and eject his dashcam’s memory card was more important that securing my work area… and look what happened.

As I sit on the couch and type this story — wishing the Ibuprofen I took an hour would finally kick the (#*$ in to silence my aching neck, back, and knees — I have to admit that I’m grateful for the reminder of the core training rule I present at the top of this column. You can be taught a security rule, but you won’t reliably follow that rule until you’ve suffered the consequences of ignoring it. Hopefully this experience will help me to have empathy for my users the next they do something comparably goofy and entirely preventable.

We’re all flawed, quai-rational creatures. We make bad decisions that make perfect sense at the moment. Most of the time nothing bad happens … which weakens our resolve to follow protocol and helps justify our deviation from standards. This is natural. As human risk professionals, it’s our job to push back on this habit with good stories, strong messages, and painful anecdotes.