Margin of safety
Human Risk Management
Firewalls don't panic.
Policies don't get phished.
People do
Human Risk:
The Real Attack Surface
Most organisations don't ignore people.
They train them. Test them. Send phishing simulations. Write policies. Run awareness campaigns.
But the human dimension of risk goes much further than whether someone clicks a link.
It's how people behave under pressure. What they question. What they ignore. What they silently work around. Whether they challenge something that doesn't feel right. And whether they feel safe enough to speak up when something goes wrong.
Margin of Safety explores that space.
It's the home of my independent speaking, research and thought leadership around Human Risk, and a different way of thinking about the role people play across cyber, information, operational, physical and emerging technology risks.
The question at the centre of it all is remarkably simple:
Where is the human?
About Me
I'm Gary Simpson, an independent speaker and senior information security leader with more than 10 years' cross-sector experience spanning health, higher education, insurance, finance and the legal sector.
Throughout my career I've worked across governance, risk, cyber security, security operations, assurance, awareness and organisational change.
But the subject that increasingly interests me isn't another framework or another technology. It's people.
Why people behave the way they do.
Why perfectly sensible controls sometimes produce unexpected behaviour.
Why people can simultaneously be one of an organisation's greatest sources of risk and one of its strongest controls.
I hold CISM and ISO 27001 Lead Auditor certifications alongside a coaching and mentoring qualification, and Margin of Safety provides an independent home for my Human Risk research, ideas, talks and methodologies.
What I do
Keynotes and conference speaking
Human Risk: The Real Attack Surface
A practical and thought-provoking exploration of the human dimension of organisational risk.
Rather than treating people simply as the person who clicks the link, I explore the much wider role humans play in identifying, creating, amplifying and reducing risk.
The aim isn't to provide another framework.
It's to encourage audiences to ask a different question:
Where is the human?
Workshops and facilitated conversations
Interactive sessions for leadership teams, security professionals, risk practitioners and wider organisational audiences.
These sessions explore subjects including human behaviour, organisational culture, psychological safety, accountability, AI and human decision-making, and the unintended consequences of controls.
The purpose is to challenge assumptions, stimulate discussion and give people practical ways to think differently about Human Risk.
Human Risk research, models and practical tools
Margin of Safety is also where I'm developing my independent work around Human Risk.
That includes models, tools and approaches that explore how organisations can recognise the human dimension already present within their existing risks and controls.
The intention isn't to replace established risk-management frameworks or create another compliance programme.
It's to provide another lens through which to look at them.
The idea behind Margin of Safety
Good organisations build controls, processes and technology to keep risk within acceptable boundaries.
But reality is messy.
People adapt.
Circumstances change.
Technology behaves unexpectedly.
Processes don't always work quite as intended.
The margin of safety is what exists between the system working perfectly and the organisation failing when it doesn't.
Very often, people are part of that margin.
They're the person who spots the unusual email.
Who questions the payment.
Who challenges the stranger following them through the door.
Who questions an AI-generated answer that doesn't look right.
Who tells us when a process isn't working.
And sometimes they're simply the person who makes an honest mistake...
and feels safe enough to tell us.
Want me to speak at your event?
If you're organising a conference, leadership event, security forum, workshop or panel and you'd like to bring a different perspective on Human Risk to the conversation, I'd love to hear from you.
Let's start a conversation.
“Your risk register may tell you what the risk is.
Human Risk asks: where are the people within it?”
Gary Simpson
Founder, Margin of Safety
Independent Speaker | Human Risk
