If you’re thinking about cyber security, you should also think about behaviour change

It’s no longer an option to view cyber attacks as something that happens to someone else, some other organisation, or just a technical issue.  It’s now standard practice for all large organisations to have measures in place to protect themselves and their assets, and these measures often include an element of culture and behaviour change .

I’ve recently been involved in a project where I helped a client change the way their workforce viewed cyber security and embed a set of new highly-secure behaviours.

The project has been very successful and I’ve even found my own behaviour changing as a result – I’ve signed up for a password manager and my laptop is now a veritable fort knox!

So what do we mean by cyber security?

In its simplest terms, cyber security is the protection of an individual’s or organisation’s cyber assets.

To protect cyber assets you need to worry about physical security as well as cyber security.  This is where you need to think about the culture and behaviours of the organisation – there’s no point having great firewalls in place, if you leave the door to your server room open!

What is a cyber threat?

There are a number of different types of cyber threat, including state-sponsored attacks, insider threats, cybercrime, cyberterrorism, physical threats (staff members leaving doors or computers unlocked) and ‘hacktivism’ (hacking a system for social or political gain). Each company will have a different profile in terms of which of these threats are the most probable and how serious the consequences of a breach could be.

How does an organisation protect itself against cyber attack?

If people don’t understand, endorse and actively support cyber security consistently throughout an organisation, it’s just a matter of time before the best of systems will be compromised.

As change professionals, the area we add value is in helping our clients identify and embed the behaviours that will support the other measures (such as technological protection) they have in place. This isn’t just a ‘nice to have’ – if people don’t understand, endorse and actively support cyber security consistently throughout an organisation, it’s just a matter of time before the best of systems will be compromised.

Affecting large-scale behavioural change

Let’s be clear about one thing: change is hard! I get uncomfortable changing my brand of toothpaste. So effecting meaningful, lasting change can’t just be a top-down approach.  For behaviours to adapt, and for change to be truly adopted, all affected staff need to take ownership and understand the importance of the change.

Here are some key methods and approaches we use at Afiniti to help our clients ensure long-term and sustainable behavioural change is achieved across the whole organisation.

1.       Build sustainable toolkits and communications

This can’t be a one-off short-burst campaign, it needs to be rolled out over a period of time for the desired behaviours to become embedded as second nature.

To help maintain a high level of interest throughout the project, try a mix of communication styles from hard-hitting and informative to softer, more subliminal messaging.

And lastly, by using a blend of channels and methods, plus appropriate language and tone, you can ensure your key messages reach all intended audience groups.

2.       Co-create and utilise real people to generate awareness and validate the programme

Take the time to understand people’s opinions and insights into their areas of work, and then involve them in the project planning and execution. This way you’ll not only gain a more rounded understanding of the business needs, but people will feel invested in the project from the beginning.

Once people feel on board and understand the importance of the changes, work with them to create content such as short videos and workshops.  This type of user-generated content can really help with marketing to external audience groups, so why not reap the benefit for your internal communications efforts too?  It’s often cheaper, more authentic and more trusted by internal audiences.

Check out our vBlog of top tips for creating user-generated content

3.       Use creative and eye-catching visual assets

As they say ‘an image can convey a thousand words’ and this is certainly true when you’re trying to present a set of important key messages. Trying to condense a long white paper into a punchy animation or presentation can be a difficult thing to do, but it also forces you to concentrate on the things that really matter and helps to bring ideas and concepts to life.

4.       Create a security champions network

By giving tools and training to a group of security champions, you can create a community which supports the wider workforce on a day-to-day basis.  The champions can share experiences, best practice and be a point of call for questions, ideas and concerns. It also really helps to see respected colleagues modelling the desired behaviours.

Read our article on Making change stick by getting the whole team on board

It’s important to bear in mind that changing behaviours and mindsets doesn’t happen overnight, these things take time to embed. The tools and approaches above will help you maintain momentum and create the emotional engagement you need to embed the desired ways-of-working on a permanent basis.

If you have any interesting insights, or experiences of behaviour change related to cyber security, we’d be interested in hearing from you, so leave us a comment.

Agility – moving beyond the buzzword

Why adopt an agile mindset?

A lot of our clients appreciate the benefits of adopting an agile mindset, as well as agile working practices.  And this makes a great deal of sense, after all, we’re living in an age of major business disruption and innovation.  Modern business must deal with a plethora of challenges, from regulation, compliance and new technologies, to the economy and exploitation of big data.  Most of these challenges can also represent opportunities, if you’re in the right shape to take advantage of them.

This led me to think about how organisations message around agility (agility in terms of organisational culture and mindset, not Agile Project Management – although these two concepts are most definitely not mutually exclusive), and how they ensure everyone is on the same page with regard to what it actually means to be agile.  Agility can often be seen as an abstract concept that is not grounded in the operational reality of an organisation; I often hear conversations around agility along the lines of, ‘but what does it really mean for us?’ Or ‘agility means speed over quality’.

 What does agile really mean for an organisation and its people?

Agility does not mean unplanned or risky, quite the opposite in fact. The goal is to be nimble and flexible – ready to pounce on opportunities, or to change course to avoid inevitable problems. To be agile, an organisation and the people within it must have a clear goal in mind with waypoints to check if the plan is on target.

Here are five principles to help you convey what agility really means in the context of your organisation:

  • Stability – to be agile and adaptive the organisation and its processes must be stable. That is stability in the sense of the organisation’s propensity for flexibility, reliability and resilience.  This is where stability and predictability should be seen as enablers for agility – many large organisations have these attributes – use them to your advantage.
  • Flexibility – this is the ability to course-correct mid project/initiative or in more extreme cases to change direction entirely.  This requires people within the organisation to accept that, ‘what was right then may not be right now’.  This is where the real mindset and behaviour change comes in, so take time get the right message across.
  • Speed – a primary benefit of agility is the speed with which things happen, while maintaining the quality of output.  This could be getting a new drug to patients, taking advantage of an emerging technology or an untapped market opportunity.  This is an output of an agile organisation, not a personal trait to ‘do things fast’.  It comes from a stable base and flexibility of mindset.
  • Culture – think about the culture of your organisation.  How do the behaviours and accepted norms fit to the principles of agility?  Tune in to those cultural aspects that align with agility and think carefully about how to message around those that may be in conflict.  This is not insurmountable and can be achieved by following a process to find the answer which is right for your organisation.
  • Get creative – we know that the best messages are ‘sticky’ in that that they are easily communicated, get re-used and tell a story.   A great way of achieving this is to represent your agile story visually.  With clear and concise thinking, which is represented with a visual identity, you will get a better spread of awareness and desire to engage with these new agile principles.  Check out our blog post on The Impact of Storytelling on Change Programmes.


In summary, the only way an organisation can adopt an agile mindset is when all of its people truly understand the principles of agile, the advantages to the business and the benefits to them as individuals.


If you have any further ideas on what agile means to you or your business, or experiences of how you or your organisation adopted an agile mindset, then get in touch via the comments below.

Good practice reminders for writing your communications strategy

Come on, be honest, how many times have you googled ‘How to write a communications strategy’?  I admit I have done so in the past, more than once.

Looking back, it’s understandable: your communications strategy represents an expedition. It maps what you want, how you plan to get it and all that might affect the journey. The strategy covers everything and yet to be useful, it must be utterly concise.

So to reduce people’s future googling, here are five things to consider when writing a strategy for communications to support people change.

1. Explore like a journalist

Any successful communications strategy will have people at its heart. You need to understand your audience: their environment and attitudes. A formal approach will include a full situation analysis. At a pinch, gather statistical and anecdotal evidence to understand your client organisation, its history, culture and the people.

Clearly, the more you know about the population you seek to change, the more accurately you can set your strategic objectives and meet them.

2. Your communications strategy should tie your goal to corporate objectives

Your strategy won’t be supported by business leadership unless it’s linked to what the organisation is trying to do. Make this connection obvious when you define the strategy’s purpose. For example, “This is a strategy to have people adopt automated HR by 2018, in order to meet our ops efficiency vision.”

And if you can do this using an engaging visual diagram, then even better.

3. Know exactly what you want people to do differently

Clarify what you want people to think, feel and do as a result of the change, and keep checking the strategic activities against that. Too often, things drift from these goals, especially when working with limited resources.

For example, an oil and gas client wanted to get better cohesion from one of their fastest growing business units. The strategy included an approach to run project meetings more effectively. They wanted people to stay focused on milestones. However the individuals involved traditionally used their face to face meetings for getting issues off their chest. It became obvious that for behavioural change, the client would need to either create additional opportunities to vent, or extend the standard meeting agenda to include it!

4. Build messaging around audience types to support your communications strategy

Develop a tight message framework around audience segments. People find it much easier to keep sight of their plans when they can picture the broad groups they’re aiming at.

For manageability, we’d recommend consolidating to five segments or fewer and creating generalised ‘personas’ to help bring these audience types to life. For example, imagine Trevor, the warehouse manager, who acts on instinct and no longer trusts automated systems (because he’s seen enough come and go). How will he respond to a request to join online training for a new warehouse management system? Again, your strategy is at its most reliable when it’s designed closely around people and their attitudes.

5. Measure and be nimble

More than just tracking progress, measurement is about being ready to respond to performance indicators. That way, you can show audiences that you’re listening as well as taking action to keep the strategy on track.

This means including qualitative feedback along with your metrics. For instance, set up a monthly panel to get ‘word on the street’ feedback as you go.

Then make sure that there is enough flexibility to answer this feedback with alternative activities. This gives room for a level of two way interaction with audiences, which keeps communications and change activities feeling fresh.

With these broad points in mind, it should be easier to draft a communications strategy that is focused enough to resonate with audiences, but avoids getting stuck in the detail. Remember, your strategy should engage your audience and resonate personally to increase the success of change adoption.

We’d love to hear your thoughts on this outline – is there a sixth point we should cover though? Let us know in the comments below.

How to get the best out of Internal Communications during business change

During a major business change and transformation there is often a need to bring in expertise and resource capacity from external consultancies to help successfully deliver, manage and embed change.  As an external team, our aim is to quickly form strong alliances with the internal teams, including sponsors, the project and the business.  However, we find over and over again, an untapped team in larger organisations is Internal Communications who can play a critical role in employee engagement activities. Although often involved at some stage of the change lifecycle it’s normally later when their lack of early involvement will prevent the project from getting the true value from this internal resource.  A team who have deep knowledge and insights into the stakeholders, effective channels, the brand and other communications activity taking place.  It seems obvious to get this team involved, the trick is to do this early. Read more

Making change stick by getting the whole team on board

“People don’t resist change. They resist being changed!” – Peter Senge.

No matter how capable a new piece of technology, or how necessary an updated process, if you don’t get the people who are to use the system on board, your change won’t stick.

Here are some tips to help bring all the affected people into the fold to ensure widespread user adoption and lasting change.

Getting the whole team on board-page-CROP2

Secure support early

Help to secure support in your change programme at local level early on in the process. You can do this by educating the whole team about what the change is, why it is happening and crucially how each of them will benefit from its implementation. It also pays to give employees the opportunity to get involved.

Be creative

Use creative communications to get the message across. There are a variety of different media, from illustrations to animation. Each business is different, so be sure to pick an art form that compliments your brand and culture. This will help your employees to get excited about the change and become more committed to its successful implementation.

Use storytelling

Being creative is of course important, but it is also crucial to have some substance. You should tell a clear and compelling story detailing why the change is necessary and how things will be better after its implementation – an enticing view of the future.

Effect change from within

Nobody likes to be dictated to, so it is vital that you work with employees and listen to their concerns. They will be a lot more receptive to change from within than top-down change, so identify and support change champions within the business who can effect change at local level and bring their colleagues on board with them. Never forget that the people should be your main focus!

Let people learn by doing

Each role within your business will have different ways of working and different skills. It is important that you accurately gauge what support and learning each set of end users will require. Remember that people will have to learn and embed new behaviours and working practices. A good way of embedding these for the long term is with close, collaborative and hands-on workshops.

Another idea is to let people help define future process too. This will not only help to ensure it is fit for purpose, but it’s also a great story – this new way of working hasn’t been written by a load of consultants, our own people created it!

Keep employees informed

During the change programme, it pays to keep people up to date with the progress of the project. By now, they should be involved in and hopefully excited about the change.

They should also have a vested interest, having understood the need for change and its benefits to them and the business.

It makes sense to keep employees informed throughout the process because ultimately, they’re going to be the ones affected. They are vitally important to the success of the implementation, so you should let them know this by including them.

Focus on the ‘swing voters’

With any major change, there will always be a keen group of early adopters, a group of detractors and the largest group, those in between, the ‘swing voters’. Just like a politician in an election, it is prudent to direct a large part of your attention on this third group. This is for two good reasons:

1) They are the largest group and therefore their collaboration is very important.
2) They are on the fence, and it will only take a relatively small amount of extra attention to bring them on board.

By involving everybody affected by the transformation in your change programme, you will greatly increase your chances of making change stick.

You might also enjoy reading ‘Employee Engagement for Business Change‘.

The impact of storytelling on your change programme

Storytelling is one internal communication trend that keeps on gathering pace.

Everyone likes a good story, and stories can be useful when explaining basic truths, whether it’s one of Aesop’s fables or as a tool to help support a change programme. This article looks at some examples.

Universal appeal.

Certain tales have an incredibly broad appeal and engage across different social groups and cultures and indeed continue to thrive across the ages. Take ‘The Tortoise and the Hare’ for instance – At its heart it is a moral tale and is still relevant today.

When communicating through storytelling, it pays to keep your story simple, moral and personal. In this way people will be engaged and not feel bombarded.

Story One: Where’s the jeopardy?

It’s not an adventure unless there is something to lose

To get a sense of jeopardy, it is important that Change Leaders expose potential weaknesses and fears – Even if convincing them to do so is challenging. Storytelling always contains negatives as well as positives.

In the past we have used first person stories to give personal accounts of the story behind the reason for change in an organisation. This has proved a good way to add credibility to a story, and it can be seen as a bold move which could win trust.

Story Two: Characters who speak for themselves.

When coordinating major change, it helps to develop characters that can help leaders to ‘show’ rather than ‘tell’ their employees what is going on.

When we worked with a major logistics company that was implementing a new way of working across its warehouses, we had to take into account the varied roles that would be affected by the change.

We developed five distinct visual characters to represent these roles, each with their own quirks. This really helped to highlight the different challenges each role would need to overcome, as well as help foster a fresh understanding of how each role would collaborate with one another.
These measures helped Change Leaders to draw people into the story of change at the warehouse, with all its entailing risks and rewards.

Story Three: A sense of purpose

Nobody likes being dictated to, so it’s important that workers feel involved. The best change programmes have a clear identity and a rallying cry – “Be a part of this adventure.”

There’s no denying that large change programmes are challenging to negotiate, as many are diverse and can be spread over years. In complex cases such as these, having a strong story becomes even more vital.

Recently, an infrastructure organisation launched a 15 year programme of change. The aims of the change were clear, but due to the sheer scope many details were and remain unknown.
What story could stay relevant over such an extended time period? In this case the company went for a tale of evolution: Its people had been handling change for 150 years. This helped its employees to feel part of something much greater – part of the adventure.

Change will always be challenging, but having a strong sense of purpose makes the journey easier. By talking about the ups and downs, challenges and successes as part of an overall story, it’s easier to connect workers with what is going on.

To be fair, storytelling has always been a part of change management. Does being bold and telling the truth lead to more successful change? It’d be great to hear your thoughts on the matter.

To read about how Afiniti can help your business with engagement and communications during change, please click here.

The Social Network: Discovering informal change leaders

When undertaking a change project, whether it be technological or process based, we always look to build a change network to act as champions for the cause throughout the organisation.

The obvious choices for these roles are usually senior leaders, line managers or team leaders, however there is an untapped resource hidden in the formal organisational structure.

Formal business leaders are the natural choice to be change champions but what about the influencers within teams, departments or business units? These types of people tend to be (but not always) the more experienced in the company, typically social within groups and well respected and trusted amongst their peers. Read more

Employee engagement tips for business change

Effective employee engagement within a project or programme of change is vital in making business change stick.

When developing an employee engagement strategy for a programme you could consider the following:

Stakeholder Analysis – what are people’s communications needs, how will the change impact each group?  And how can you keep them informed and supportive of your employee engagement programme?

Communications channels – What channels are available to encourage genuine two way feedback?  And what new ones can be introduced?

Learning and training – if there is learning and training to be delivered as part of the programme how do we make sure it is collaborative and adapts to the needs and continuous feedback of users?

Acting on feedback – Asking the right questions is only part of this; if you don’t start a conversation with the results, you won’t engage your audience.  Maintaining the conversation and interest is vital to achieving sustainable results.

So how can we interact powerfully and maintain employee engagement?

Leadership during business change needs to be active and involved in talking to people. Many project sponsors aren’t especially confident in walking the floor and talking to people. And if they’re not, then encouraging a presence online or at meetings is an alternative.

Forums, focus groups and workshops all give real opportunity for conversation – they are especially useful if employees are in one place. A community hub allows members of different teams to meet allows for the sharing and development of ideas and project and business objectives.

But what happens after the meetings?  A network of ‘change agents’ can keep the information flowing and gather continuous feedback.

Remote locations might not always be served well by physical meetings but an online Q&A with leadership and HR can serve to unite employees across different geographies.


Open and honest employee engagement needs the right company culture to support it. Different companies have various levels of openness. But employee engagement itself, although facilitated by a culture of openness, has the ability to produce it as well.

We worked with the head of a large health organisation and experienced how the closed culture stopped people from asking questions. We listened to people and submitted questions on their behalf anonymously and gradually people became more open and asked more themselves because it became clear it was safe to do so.

Culture change doesn’t happen overnight, but you can plant seeds that will grow over time.  Creating an open and safe culture in which people can ask questions is certainly beneficial but responding to and acting on that feedback achieves so much more.


Connect with Tom on LinkedIn

Common presentation mistakes

Giving a presentation to your client can be one of the most nerve-wracking experiences a consultant can go through. It’s pretty to avoid some common blunders.

There are plenty of tips out there suggesting what you should and shouldn’t do with PowerPoint or Prezi so I’m not going to replicate any of that.  Also, I won’t insult you by saying ‘do your homework’.  That’s a given – knowing your subject matter inside out is generally essential.  However, here are my top 5 things to avoid:

  • Using someone else’s material – responding to a query by saying ‘sorry, these aren’t my slides’, doesn’t look good.  You should always present your own information and be prepared to defend it.
  • Not knowing your audience – avoid any surprises by finding out who is going to be at the meeting. This will help you get the right level of information in your presentation.
  • Over-reliance on your slides – your content should be there to support you, not the other way around.  You want people to listen to you and not be distracted by the content on your slides.
  • Just reading your content – non-verbal communication is extremely powerful and should be used to full effect.  A strong and positive posture, eye contact and verbal delivery build credibility and add weight to your opinions.
  • Lecturing –  you’re probably an expert at what you do.  However, it’s important not to come across as if you know everything.  If your colleague wants to interrupt, or ask a question, let them.  Make it a discussion, and you’ll both come out of the meeting feeling better.

Finally, and probably most difficult if you’re nervous, try smiling.  People want to hear from you, so try not to look like it’s an ordeal.

Have you got any presentation tips or things to avoid?