Your Corporate Culture Is a Hacker’s Playbook— and most executives have no idea
- PYXIS
- Apr 27
- 4 min read
“There are only two types of companies in the world: those that have been breached and know it, and those that have been breached and don’t know it.” — Ted Schlein
That quote should make every executive uncomfortable.
Because here’s what the data is telling us: the FBI reports a 300% increase in cybercrimes since 2019. Global cybercrime costs are estimated at $10.5 trillion in 2025. In the UK alone, an estimated 21,315 attacks occur every single day against businesses.
And yet, most leadership teams are still treating cybersecurity as an IT problem.
It isn’t. It’s a culture problem.
The Uncomfortable Truth Most Leaders Won’t Accept
Sophisticated cybercriminals don’t begin their attacks on your servers or your software. They begin with your people.
They study your organization like anthropologists. They map your communication patterns, your org chart, your decision-making rhythms. They identify the trust relationships that make your business function.
Then they use your culture against you. They turn your employees into unwitting accomplices, not through technical wizardry, but through a precise understanding of human behavior. Phishing campaigns succeed not because they crack encryption. They succeed because they mimic the internal communication patterns your people already trust.
Consider what happened at Morgan Stanley: employees received IT support emails requesting password resets. The attack worked because it looked exactly like something internal. The resulting data theft cost $60 million in compliance penalties. Not a technology failure. A culture failure.
The Behaviors That Make You Successful Also Make You Vulnerable
Here is the uncomfortable paradox at the heart of cybersecurity: the very cultural qualities that drive business performance are the ones criminals exploit most effectively.
Trust. You need trust to collaborate efficiently. Criminals exploit it through pretexting, impersonating executives, posing as internal colleagues, and creating false urgency.
Helpfulness. You hire people who want to solve problems and support their colleagues. Social engineers weaponize that instinct daily.
Respect for authority. Hierarchy enables coordinated decision-making. Attackers exploit it by impersonating senior leaders to bypass verification instincts.
Curiosity. Innovation depends on curiosity. Baiting attacks, like USB drives labeled “Employee Bonus Structure” found in parking lots, turn that curiosity into a security breach.
Quid pro quo attacks (such as the Marriott Hotels breach, where attackers offered “system upgrades” in exchange for access credentials) succeed because they provide immediate value while creating time pressure that discourages verification.
The criminal playbook isn’t sophisticated technology. It’s sophisticated cultural psychology.
Why Most Cybersecurity Strategies Fail
Most organizations invest millions in detection systems and allocate minimal resources to understanding the human behaviors that determine whether those systems succeed.
Then, leadership expresses surprise when excellent technical implementations produce organizationally disastrous outcomes.
The failure is in the approach. Security training that makes employees suspicious of everything doesn’t create a safer organization. It creates either a paranoid workplace where productivity collapses, or a culture that pays lip service to security while continuing risky behaviors.
Real cybersecurity resilience isn’t about building cultures on the assumption that incidents won’t happen. It’s about building cultures on the assumption that incidents will happen, and ensuring your people are equipped to detect, respond, and communicate effectively when they do.
What Culture-Led Cybersecurity Actually Looks Like
Forward-thinking organizations are shifting from a prevention-only mindset to one that balances prevention with rapid response and transparency.
This requires:
Leadership that models the behavior: security cultures are built from the top down, not the policy document up
A genuine speak-up culture: employees must feel safe reporting suspicious activity without fear of blame or ridicule
Verification as a cultural norm: not paranoia, but healthy professional skepticism built into everyday workflows
Resilience over perfection: accepting that breaches will happen and building the cultural infrastructure to manage them
The organizations that get this right will attract better talent, retain institutional knowledge through crises, and maintain stakeholder trust during inevitable security events.
Those who continue treating cybersecurity as an IT problem will discover that technical investment provides minimal protection against adversaries who understand the real target: your culture.
The Bottom Line
The most sophisticated criminals in the world aren’t trying to crack your encryption. They’re reading your employee handbook.
A weak cybersecurity culture is the hacker’s key to the vault. But a strong one, built on the right behaviors, leadership commitment, and genuine organizational resilience, is the most powerful defense you have.
Culture is the ultimate vulnerability. And it can be the ultimate defense.
About PYXIS Culture Technologies
PYXIS Culture Technologies helps organizations understand and improve the cultural drivers of performance, safety, and cyber resilience.
By combining deep research, operational experience, and advanced culture analytics, we help organizations close the gap between strategy and everyday behavior.
The PYXIS approach is effective:
We treat culture as a systemic business issue, not an HR initiative.
We identify key internal business practices that create performance and risk challenges and provide effective solutions you can immediately implement.
We link organizational culture to business and financial metrics, showing a clear ROI for strengthening alignment and performance.
Connecting the dots
If the ideas above resonate with what your organization is facing, it may be worth exploring what a structured diagnosis of your cybersecurity culture would reveal.
About the Author
Christiane Wuillamie OBE is an advisor to senior leaders on cybersecurity culture and IT transformation.
She has decades of experience advising boards and executive teams across Fortune 500 and FTSE 250 organizations. Christiane is a successful entrepreneur and business executive who founded a pioneering IT services company and grew it 100% year on year into a multimillion-pound enterprise, achieving a successful trade sale in 2001. Christiane’s passion is blending technology, agile tools, and cross-functional business processes with culture change to drive business transformation projects that deliver greater business agility, speed to market, and a significant competitive advantage.