Security culture and human risk management: how a CSO frames it

The question and the sources

Andrew Rose is Chief Security Officer at SoSafe. This page draws on three documents: a SoSafe write-up of an episode of its Human Firewall Podcast, updated on 24 September 2025, a SoSafe press release dated February 7th, 2024, and a Proofpoint post dated 5 November 2020. Together they show how Rose describes security culture and human risk management, and which earlier jobs came before the SoSafe role. Each point below is attributed to the document it comes from.

How Rose describes security culture

The podcast write-up gives a working definition of the term. It says organisations should create a way of working where people make the right choices even when the security team is not looking.

The write-up also admits that the term is often used loosely. It says a security culture is something many CISOs want, but not many of them really know what that means.

It describes a progression it calls Awareness, Behavior, Culture, or ABC. The write-up says organisations need a structured strategy that takes employees from understanding security practices to translating them into secure behaviour, and ultimately to a security culture.

On what shapes culture, the write-up points to peers. It says social pressure plays a crucial role, and that peer influence often outweighs policy directives.

The write-up also names a tool for using that pressure: security champions. It says designating champions across departments can reinforce security messages and provide peer support.

The episode overview lists "highly hierarchical organisational cultures as a risk factor for attacks" as its own topic. It cites the Asiana Airlines crash as an example, describing a case where national culture made a copilot hesitant to warn the pilot about a mistake in the landing procedure.

How he frames human risk management

The write-up treats training as the starting point and not the finish. It says security awareness and training are where organisations need to start to get the foundation, but they need to go deeper and actively monitor and manage the risks associated with human behaviour and actions.

It describes the change in the awareness industry the same way. According to the write-up, the move towards human risk management signifies a shift from compliance-driven approaches to actively monitoring and managing human-related risks.

The write-up pairs this with a just culture. It says companies should motivate employees, create the right environment for them to succeed, and let them know they will not be blamed for their mistakes. It adds that the company should use the reported mistakes to look at and improve its internal processes.

The write-up also lists the CISO's own position as a challenge. It says one of the main challenges CISOs face is defining their responsibilities, which vary drastically from one organisation to another.

The earlier CSO and CISO roles

The press release lays out the career in sequence. It says Rose has transformed security management for major organisations in the legal, aviation, technology and finance sectors.

On the legal side, the release says he spent over a decade as CISO at the "magic circle" firms Clifford Chance LLP and Allen & Overy LLP.

In aviation and finance, the release says he oversaw the cyber security of UK airspace traffic at NATS and managed the secure processing of trillions of pounds in transfers at Vocalink, a Mastercard company. The Proofpoint post adds that at NATS he oversaw a security transformation and contributed to the design of the next generation air traffic control system.

The analyst and vendor steps that point to culture work

The Forrester years connect most directly to the culture theme. The press release says he was Principal Analyst covering the awareness and culture change space and developed influential models for the security awareness industry. The Proofpoint post describes the same period, saying he covered the role of the CISO and Security Culture and Awareness as two of his specialty areas.

The release then links the analyst work to a practical result. It says that in 2015, when Rose implemented the models he had designed at Forrester, he was awarded "UK Awareness Campaign of the Year" at the UK Cyber Security Awards.

At Proofpoint, the release says he was Resident CISO, helping customers enhance their security practices, cultivating a community of CISOs and representing the brand externally. The Proofpoint post of 5 November 2020 reports that he was recognised in the inaugural CSO30 awards, and quotes CSO Online UK editor Dan Swinhoe citing his mentoring work, his involvement with CyBOK, his transformation efforts and his drive to improve security behaviours.

The move to SoSafe

SoSafe's announcement, dated Cologne, February 7th, 2024, says the company appointed Rose as its new Chief Security Officer.

The release gives Rose's own reason for joining. He is quoted saying the biggest part of security budgets goes to security technology, while according to the World Economic Forum, 95% of cyber threats have a human element involved.

He also describes how SoSafe works. Rose is quoted saying the company focuses on behavioural science to tackle the problem and then uses technology to enable the solution.

Read together, the documents line up. The culture and awareness work Rose covered at Forrester, the awareness campaign he ran in 2015, and the people-centric roles at Proofpoint all sit on the same theme as the human risk management view he gives on the podcast.