Cybersecurity · global health insurer
Secure email handling at the moment of risk
What was driving employees to send sensitive information to unauthorized or insecure addresses?
Secure handling of sensitive information at the point an email is addressed and sent.
Project questionWhat was driving employees to send sensitive information to unauthorized or insecure addresses?
What was driving employees to send sensitive information to unauthorized or insecure addresses?
Employees were sending sensitive information to unauthorized or insecure email addresses.
The useful reframe
The risk could not be reduced by treating every breach as a knowledge deficit. The project examined the behavioral influences present at the moment an employee chose an address and completed the task.
The work
From question to something a team could use.
Project work used surveys, interviews, desk research, co-design workshops, and a behaviorally informed prototype to address the barriers.
- 01
Study the decision moment
The research centered on current cybersecurity behavior at the point of sending. Surveys and interviews were read alongside desk research.
- 02
Co-design practical responses
Stakeholders worked through the diagnosed influences. The operating context shaped both the strategy and its content.
- 03
Make the response tangible
The response was made tangible in a prototype. Its behavior-change techniques could be inspected instead of discussed only in the abstract.
Capabilities used
Turn a risky employee action into a response the team can inspect and test.
Mixed-method diagnosis
Survey and interview evidence was combined with desk research to examine one high-risk action.
Decision-moment analysis
The anchor was concrete: selecting an address and sending sensitive information.
Stakeholder co-design
Security, operational, and communication constraints all mattered. Co-design brought the people who understood those constraints into the response.
Behaviorally informed prototyping
A prototype made the proposed techniques visible early, when the organization could still question the logic and change the design before implementation.
What the project produced
- Survey and interview research
- Behavioral analysis
- Co-design workshops
- Behaviorally informed prototype
- Stakeholder presentation
Evidence
A diagnosis and prototype for the moment of risk.
- Documented
- The behavioral diagnosis, co-design process, and resulting prototype.
- Measurement scope
- A subsequent reduction in data breaches.
Next case · Organizational change · consumer goods company
Friction after an organizational restructure
Feedback and meeting practices were getting in the way of productivity and wellbeing after an organizational restructure.
Read the next case