Culture is what people do
when no one is watching.

Not what leaders say matters — what they ask in the first five minutes of a status meeting. If the VP always asks about schedule and never about quality debt, you have a schedule culture regardless of the wall art.

People optimise for the question they know is coming. Change the question and the optimisation target moves with it, without a single policy edit.

If the person who ships fast by cutting corners gets the director role, everyone recalibrates within a quarter. No memo required — people read the outcome, not the intent.

The inverse is equally powerful and much cheaper. If someone escalates bad news and is visibly protected rather than punished, you have bought psychological safety more effectively than any training module could.

Pre-hardened pipelines. Templated threat models. SBOM generation in CI. Secrets managers that are faster than pasting into chat. The goal is that no engineer ever has to choose between shipping and complying.

Anything that depends on sustained willpower will fail. Anything that changes the default will hold, quietly, for years.

You cannot fabricate these stories, and attempting to is transparent. What you can do is create the events that become them, and then make sure they circulate.

One engineer who reported a costly mistake and was publicly thanked will do more for reporting rates than three years of awareness messaging. The story travels on its own.

1. Pull twelve months of incidents and near-misses. Split them into self-reported versus found by tooling or a customer. A low self-reported share means people are not telling you things, and no reporting campaign will fix that.
2. Read the last eight promotion justifications in engineering. Note whether risk, quality, or reliability work appears at all. This tells you what the organisation actually rewards.
3. Sit in three status meetings and say nothing. Write down the first three questions each leader asks. That transcript is your culture, documented.
4. Ask five engineers privately: "What is the last thing you decided not to escalate, and why?" The reasons are your diagnosis.
5. Pull the exception request log. Count the volume, note who files them, and check whether reasons are captured. If reasons are not recorded, that is finding number one.

1. Identify the single control with the highest violation rate. Treat that as a friction signal, not a discipline signal, and pave it first.
2. Build one golden-path pipeline template with SAST, SCA, secrets scanning, and SBOM generation pre-wired. Make it the default in your repository scaffolding, so a new service is compliant on creation.
3. Publish threat-model templates per architecture class, each pre-filled with the five threats that class always has. A blank STRIDE canvas is a tax; a pre-filled one is a head start.
4. Move the secrets manager into the CLI and IDE people already use. If it requires opening a separate portal, it will lose to pasting into chat.
5. Time both paths with a stopwatch and publish the comparison. If secure is slower, you have not finished.
6. Retire one control for every two you automate. Friction has a budget, and most programmes have been overdrawn for years.

1. Write the blameless review standard before you need it. One page: the questions that get asked, and the questions that never get asked.
2. Separate learning review from performance management in writing, then honour it absolutely. One violation of that boundary costs three years of trust.
3. Take the next real incident with a human cause. Run the review openly. Have the person involved present it themselves, and have leadership thank them by name.
4. Have the most senior person in the room name one of their own mistakes first. This is the cheapest move in the entire plan and most leaders skip it.
5. Publish the write-up internally. Name individuals only in the acknowledgements, never in the findings.
6. Then stop talking and let it travel.

1. Get one metric onto the existing executive business review. Do not create a security forum — forums are where security topics go to be contained.
2. Choose vulnerability ageing or remediation performance, not a posture score. It must be something a product leader can personally act on.
3. Give it an owner in Product who presents it. If the CISO presents, it stays a security topic.
4. Brief the CEO or CPO on the one question to ask every time: "What is our oldest unremediated critical, and who owns it?"
5. Hold the question steady for three quarters. Changing it early resets the signal and teaches people the metric is decorative.

1. Baseline five measures: median time to report, design-review coverage before architecture freeze, mean time to remediate by severity band, exception volume with reasons, and unmanaged secrets in repositories.
2. Instrument time-to-report first. It is the best available proxy for blame orientation and costs almost nothing to capture.
3. Report exception reasons as a categorised list rather than a count. Those categories are your friction backlog, handed to you for free.
4. Publish per-team and unranked. Ranking produces gaming; visibility produces conversation.
5. Remove training completion from every dashboard an executive can see. While it is visible, it will be managed instead of the real thing.

1. Name a security champion per product team with real allocation — ten to fifteen per cent of capacity in the sprint plan. Volunteering is not ownership.
2. Put a product security objective into the product organisation's own OKRs, owned by a product director who reports on it.
3. Move design-review approval rights into the line. Security advises and retains escalation, but does not hold the gate.
4. Add product security to the definition of done, not to a checklist at release. Late checklists are where friction is discovered too late to absorb.
5. Fund it from the product budget. The moment it is a security cost centre, it becomes optional under pressure.
6. Redirect the security function to standards, tooling, and hard cases. If security is still doing the reviews, ownership has not moved.