Why I Started HumanSecIQ

A few years ago, I applied for a loan and got denied. I moved on, opened an account elsewhere, and didn't think much more about it.

Then, a couple of weeks later, an email landed in my inbox: a personal note saying the decision had been reconsidered, the denial was a mistake, and they were ready to move forward. They just needed some information from me.

I was driving when I read it. My first reaction wasn't suspicion. It was frustration. I'd already moved on from that process.

But that reaction is exactly what I've trained myself to notice. When something creates a sudden spike of emotion, whether frustration, urgency, confusion, or relief, I pause and ask why.

So I looked closer.

The logo. The sender address. The request buried in the email.

It took a few minutes of real attention before I found the detail that gave it away. It was a phishing attempt that aligned almost perfectly with an emotional situation I had already experienced.

Attackers take advantage of urgency, frustration, curiosity, fear, trust, and other factors that can influence decision-making. And increasingly, the messages themselves can be polished, personalized, and convincing.

Artificial intelligence is changing this landscape further. Poor grammar and obvious mistakes were never sufficient ways to identify phishing, and they are even less useful as primary warning signs when generative AI can help produce fluent, convincing communications. Advances in synthetic voice and video also make it increasingly important to think beyond whether a message simply looks or sounds legitimate.

The old advice to look for typos and poor grammar doesn't go far enough.

What matters more is helping people recognize manipulation, slow down when something feels urgent or unusual, verify through appropriate channels, and make better decisions when the answer isn't obvious.

That belief is part of what led me to found HumanSecIQ in 2022.

My background spans mathematics, education, and program leadership. On the surface, those disciplines may seem unrelated to cybersecurity. To me, they have always revolved around a similar question:

How do people learn, make decisions, and change behavior?

My background in mathematics taught me to think analytically, identify patterns, and approach problems systematically. My years in education taught me something I continue to come back to: information alone is not enough to create lasting change.

People need opportunities to apply what they know, practice decisions, receive feedback, and work through situations where the right answer may not immediately be obvious.

The same principle applies to cybersecurity.

I've sat through the other kind of training.

The annual compliance course. The slide deck everyone clicks through. The quiz that requires little thought. The completion certificate that proves participation but tells us very little about what someone will actually do when confronted with a convincing phishing email, an unusual request from an executive, or a security decision under pressure.

I learned very little from those experiences, not because I couldn't learn, but because the format rarely asked me to think.

That experience shaped how I think about human risk management today.

Organizations invest heavily in cybersecurity technology, and they should. Strong technical controls are essential. But security outcomes can also depend on decisions people make: whether to trust a message, share information, approve a request, use a particular tool, report something suspicious, or find a workaround when an approved process gets in the way of getting work done.

The conditions surrounding the decision matter: the controls in place, the process the employee was following, the information available to them, the expectations established by leadership, and the pressures under which they were working.

That distinction matters.

If every mistake is treated as an employee problem, organizations risk overlooking the systems and conditions that made the mistake easier to make.

Today, that challenge is becoming even more significant with the rapid adoption of artificial intelligence.

AI is creating enormous opportunities for organizations. It can improve productivity, accelerate workflows, support analysis, and help employees solve problems faster.

Employees recognize that value immediately.

The challenge is that adoption can move faster than governance.

Imagine an employee who needs to summarize a report, analyze a spreadsheet, draft a proposal, or review a large document. If their organization has not provided an approved AI solution or clear guidance, that employee may turn to a publicly available AI tool.

From their perspective, the immediate problem has been solved.

Most employees are focused on doing their jobs well. They are not evaluating vendor terms, enterprise security controls, data-handling requirements, or AI governance frameworks every time they encounter a useful new tool.

Organizations therefore have a responsibility to provide clear expectations, approved tools, workable processes, and enough guidance for employees to make appropriate decisions.

This is where shadow AI can emerge. Employees adopt tools that help them work more efficiently while the organization may have limited visibility into which tools are being used, what information is being shared with them, and what risks those uses introduce. Demand for productivity can move faster than policy, governance, and implementation.

The answer isn't simply to blame employees for using useful technology. Nor is it to assume every new AI tool should be blocked.

The more useful question is whether an organization understands how AI is actually being used, what risks different uses create, and whether it has established the governance, processes, controls, and expectations necessary to support responsible adoption.

Organizations navigating this transition need to understand not only the technology, but how people actually interact with it. That requires technical controls, but it also requires leadership, communication, governance, and a realistic understanding of how work gets done.

That thinking sits at the heart of HumanSecIQ.

Through human risk assessments, AI governance assessments, and security culture services, HumanSecIQ helps organizations understand how behavior, organizational conditions, technology use, and governance interact to create risk. The work is designed to turn those findings into practical priorities leaders can act on.

Technology will continue to evolve. New threats will emerge. New tools will appear. Organizations will continue adapting to them.

What will remain important is understanding the people who use those systems, the environments in which they make decisions, and the governance that shapes those decisions.