Employee Sentiment as an Early Warning Signal
In this episode of Compromising Positions, we ask a question that should make every security leader a little uneasy: what if your employees’ reviews already know you’re about to be breached?
Lianne shares her research, on using natural language processing and Glassdoor reviews to spot the cultural, operational and psychological conditions that show up in the years before a major cyber incident. Her Cyber Risk Feature Index builds on earlier work on corporate misconduct, which predicted fraud and regulatory failures two to three years in advance, and applies the same thinking to cybersecurity.
The findings are uncomfortable for anyone who believes security is purely a technical problem. Across the organisations studied, the strongest warning signals weren’t unpatched servers. They were governance and accountability gaps, workplace stress and burnout, and constant change with too little training.
We also dig into why breaches rarely come down to one person clicking one link. They reflect accumulated decisions about workload, budget, training and leadership that leave people overloaded, and overloaded people take shortcuts.
And if unfiltered employee voices are some of the best outside-in business intelligence you can get, are you listening to them?
In This Episode, We Discuss:
Glassdoor as a Cyber Risk Signal: Why public employee reviews capture what internal surveys miss.
The Cyber Risk Feature Index: How a word list built from around 100 academic papers on insider threat, linguistics, behavioural science and security culture was used to score cyber risk over time.
No Patch for People: Why technical controls alone can’t address the large majority of incidents rooted in human and organisational decisions, and why AI-accelerated threats make this more pressing.
From Retrospective to Proactive: How leaders can act on these signals now, and why correlating sentiment with leadership changes, restructures and sudden shifts to remote work gives the data context.
Show Notes
Special thanks to our episode sponsor, Leeds based AI Consultancy specialising in AI Ethics, Security and Transformation NorthStar Intelligence- From Ideas to Impact. AI that works for people
Tone at the Bottom: Measuring Corporate Misconduct Risk from the Text of Employee Reviews by Dennis W. Campbell and Ruidi Shang (2022)
Oredev Developer Conference (Lianne’s talk will appear on their Youtube channel!)
From Dark Triads to Patriotic Hackers: Human Maliciousness in Cybersecurity - by Compromising Positions
SebDB : The World’s Cybersecurity Behaviour Database by CybSafe
Cha, Cha, Cha, Changes! How to get Excited About Organisational Change by Compromising Positions
Speakerinnen.org - A website aimed at helping you find more women speakers
Emergency Germany - A free cybersecurity tabletop event happening on 3rd December
Also, check out our sister podcast Tech Film Noir!
