FRC ERIE SUMMIT  ·  KEYNOTE RECAP

People Are the Only Link

George Finney on why the future of cybersecurity is built on people, not just tools.

A recap of George Finney’s keynote at the FRC Erie Summit. George Finney is a CISO, bestselling author, and founder of Well Aware Security.

At the FRC Erie Summit, featured keynote speaker George Finney gave the room a lot to think about. With two decades of experience helping organizations strengthen their security posture, his message in Erie was simple: the future of cybersecurity depends less on the tools we buy and more on the people who use them.

People Are the Only Link

Finney opened by challenging one of the industry’s most repeated phrases. For years, security professionals have called people the weakest link. He disagrees. People, he argued, are the only link. They build the technology, they design the processes, and they choose whether or not to follow them. Framing security as “people, process, and technology” misses the point, because all three come back to people.

“People are the weakest link. That’s the unofficial motto of cybersecurity. I actually think people are the only link. It’s not people, process, and technology. It’s really all people.”

George Finney, FRC Erie Summit keynote

Culture Eats Cybersecurity for Breakfast

That idea set up his central theme: culture. Riffing on the famous line that culture eats strategy for breakfast, Finney says culture eats cybersecurity for breakfast too. A great strategy will not survive an organization that has not been brought along with it. To make something as demanding as zero trust sustainable, teams have to build a culture where security is shared, not imposed. Leaders who overlook the reality on the ground, he warned, watch their best plans get eaten alive.

Change Behavior With Habits, Not Fear

Finney also pushed back on how the industry tries to change behavior. Too often, security leans on fear to stop people from clicking the wrong link. He prefers positive reinforcement and small, repeatable habits, drawing on research into how habits actually form. A few of the ideas he shared:

• Habit stacking. Attach a new security behavior to something you already do, like checking your alerts while your morning coffee brews.
• Reward, not fear. Pairing a behavior with a small reward makes it stick far faster than scare tactics.
• Proof it works. Users who adopted these habits clicked phishing messages far less often and reported suspicious ones far more.

Everyone Has a Security Strength

A big part of his approach is recognizing that everyone brings different strengths. Instead of expecting every employee to be equally skeptical, vigilant, and technical, Finney encourages leaders to think like coaches: identify each person’s natural security strength, then build a team that covers all the bases. It is the thinking behind his book Well Aware and the nine habits at its core, four that you practice internally and five that you use when working with others. The goal is not to make everyone perfect at everything, but to rely on one another’s strengths and build the team from there.

The AI Reality

Finney grounded the conversation in today’s fast-moving reality, including the rise of AI. He walked through how frontier models are accelerating both attackers and defenders, and how AI-driven incidents are already testing assumptions security teams have relied on for years. His takeaway was measured rather than alarmist: AI raises the stakes, but the answer has not changed. Strong zero trust, paired with a people-first culture, is still the path forward.

Zero Trust Is a Strategy, Not Just Architecture

Finally, Finney corrected a common misconception. Zero trust is not about refusing to trust people. It is a strategy for containing breaches by tightening the trust relationships inside our systems, and for getting everyone aligned and moving in the same direction. Architecture is one tactic that supports it, not the whole story. Understand what matters most to the business, design protections around those crown jewels, and work outward from there.

Key Takeaways

• People are the only link, not the weakest link.
• Culture is what makes a security program sustainable.
• Habits and positive reinforcement beat fear for changing behavior.
• Build teams around complementary security strengths.
• AI raises the stakes, but zero trust plus culture is still the answer.

Explore more highlights from the FRC Erie Summit: https://fedresources.com/frc-erie-summit/