The woman who tells Britain's boardrooms their training is rubbish just got an MBE
Amy Stokes-Waters, founder of The Cyber Escape Room Co., is appointed MBE for services to cyber security. Her method is walking into a room full of executives and telling them, plainly, that their security training is a waste of everyone's afternoon.
Most people soften the message for the boardroom. Amy Stokes-Waters books the meeting specifically to deliver it. This week the founder of The Cyber Escape Room Co. was appointed MBE for services to cyber security, an honour for a woman whose entire career is built on saying the thing every CISO is quietly thinking and nobody wants to put in a slide.
The thing being: the annual training does not work. Never has.
“I've spent years walking into companies and telling them their training is rubbish,” she said, when we reached her. “And then telling them mine is brilliant. Turns out that's a public service now. Who knew.”
Her argument is uncomfortable precisely because it is simple. People sit through the compliance module, tick the box, pass the quiz, and then hold the door open for a stranger the following Tuesday because their hands are full and it would be rude not to. Knowing the rule was never the problem.
“People don't rise to the level of their training. They fall to the level of their instinct. You can't fix that with a leaflet.”
Rather than lecture, her company runs immersive cyber security training that stages the whole thing: teams are dropped into a live incident, handed real decisions under real pressure, and scored on what they actually do, not what they swore they'd do back in March. It is closer to a fire drill than a classroom, and that is the point.
She is fond of a figure from her own research: that 96 percent of people who clicked a risky link knew, in the moment, that it was risky. “Awareness was never the gap,” she said. “Everyone already knows. Knowing and doing are different sports, and the industry keeps selling knowing.”
Asked whether the medal might make her more diplomatic, she laughed. “No. If anything it's permission. Stop training people. Start rehearsing with them. I'll be saying exactly the same thing next week, just slightly louder, and now with initials after my name.”
The Cyber Escape Room Co. was, characteristically, already selling tickets by the afternoon.