# Secure by Choice



## About

**URL:** https://securebychoice.com
**Tagline:** For those of us who choose to be cyber secure
**By:** Sarah Aalborg

## Pages

- [Opskrivning awareness til adfærd](https://securebychoice.com/opskrivning-awareness-til-adfærd)
- [Det sikre valg](https://securebychoice.com/det_sikre_valg)
- [book](https://securebychoice.com/book)
- [Rådgivning](https://securebychoice.com/rådgivning)
- [Privacy Policy](https://securebychoice.com/privacy)
- [Nyhedsbrev](https://securebychoice.com/nyhedsbrev)
- [Kurser1](https://securebychoice.com/kurser1)
- [Foredrag](https://securebychoice.com/foredrag)
- [Fra awareness til adfærd](https://securebychoice.com/fra-adfærd-til-awareness)
- [Om mig](https://securebychoice.com/om-mig)
- [Ydelser](https://securebychoice.com/ydelser)
- [Kontakt](https://securebychoice.com/kontakt)
- [Bøger](https://securebychoice.com/bog)
- [Masterclass i IT Sikkerhedskultur](https://securebychoice.com/masterclass-i-it-sikkerhedskultur)
- [Forside](https://securebychoice.com/)

## Blog

- [Your brain is sabotaging your cybersecurity tools](https://securebychoice.com/blog/110512-your-brain-is-sabotaging-your) by Sarah Aalborg (Sep 29, 2025): You can have the best SIEM, solid incident response plans, and talented analysts... and still miss critical threats.
The problem isn’t always the technology.

It’s the human brain.

In this post, I share how cognitive biases silently shape the way we configure, respond, and investigate and why understanding them is key to stronger security.
- [We see what we expect – and miss what matters](https://securebychoice.com/blog/108175-we-see-what-we-expect-and-miss-what) by Sarah Aalborg (Jul 2, 2025)
- [Navigating bias in compliance – A brainy approach to staying secure](https://securebychoice.com/blog/100413-navigating-biases-in-compliance) by Sarah Aalborg (May 17, 2025)
- [You’re not fighting ignorance. You’re fighting instincts.](https://securebychoice.com/blog/106002-you-re-not-fighting-ignorance) by Sarah Aalborg (Apr 14, 2025)
- [Knowledge doesn’t equal action—culture does!](https://securebychoice.com/blog/105261-knowledge-doesn-t-equal-action-culture) by Sarah Aalborg (Mar 17, 2025)
- [Why optimism bias is sabotaging your security strategy](https://securebychoice.com/blog/103347-why-optimism-bias-is-sabotaging) by Sarah Aalborg (Feb 10, 2025)
- [Make security feel good: hacking the brain's reward system](https://securebychoice.com/blog/103342-make-security-feel-good) by Sarah Aalborg (Jan 27, 2025)
- [Train your brain for cyber secure habits](https://securebychoice.com/blog/103298-train-your-brain) by Sarah Aalborg (Jan 16, 2025)
- [Stop Writing Crisis Plans for People—Write Them for Elephants Instead!](https://securebychoice.com/blog/102392-crisis-plans-for-people) by Sarah Aalborg (Dec 4, 2024): When Crisis Strikes, Your Brain Isn’t Rational

Think you’ll stay calm, collected, and rational in the middle of an IT crisis? Think again. During a crisis, your brain is hijacked by stress hormones like cortisol and adrenaline. This triggers System 1 thinking, a term popularized by Daniel Kahneman, where decisions are fast, instinctual, and often shaped by cognitive biases.

In other words, the deliberate, logical mindset you used when writing your IT contingency plan disappears—and with it, your ability to navigate complexity. Flowcharts, dense role descriptions, and detailed RASCI matrices? Forget it. Your brain simply doesn’t have the bandwidth.
- [How framing bias shapes our cybersecurity decisions](https://securebychoice.com/blog/100861-how-framing-bias-shapes-our) by Sarah Aalborg (Oct 27, 2024)
- [How Optimism Bias Can Blindside Your Cybersecurity Efforts](https://securebychoice.com/blog/100860-how-optimism-bias-can-blindside-your) by Sarah Aalborg (Oct 7, 2024): We all want to believe the best, but when it comes to cybersecurity, optimism bias can be a serious blind spot. It can cause us to underestimate threats, overestimate our defenses, and leave critical vulnerabilities unchecked.

In this post, I explore how optimism bias affects risk assessments, incident response, and strategic planning—and share practical tips to help you combat it.
- [Are you afraid of numbers?](https://securebychoice.com/blog/100858-are-you-afraid-of-numbers) by Sarah Aalborg (Sep 22, 2024): Do numbers make your head spin? You're not alone! In this post, I share why our brains aren’t wired for big numbers and how storytelling can help make data more relatable—especially in risk assessments and security awareness. Let’s make numbers count for real! 

#RiskManagement #SecurityAwareness #DataStorytelling #CognitiveBias
- [Unlocking the power of visual identity](https://securebychoice.com/blog/100548-visual-identity) by Sarah Aalborg (Sep 16, 2024): Discover how a strong visual identity can enhance your IT security department's credibility and communication. Learn how subconscious biases influence perceptions and get practical tips for implementing a cohesive visual identity strategy.
- [How feedback bias can turn simple nudges into stronger security habits](https://securebychoice.com/blog/100546-feedback-bias) by Sarah Aalborg (Sep 8, 2024): Learn how feedback bias influences cybersecurity behavior and discover practical tips to use feedback mechanisms like password strength indicators to encourage stronger security habits.

- [Decision fatigue can undermine your cybersecurity](https://securebychoice.com/blog/100306-decision-fatigue) by Sarah Aalborg (Aug 28, 2024): We cybersecurity professionals face a constant barrage of decisions: from triaging alerts to assessing risks. But did you know that the sheer volume of these decisions can lead to something called decision fatigue?
This phenomenon can subtly degrade your security posture even though it was thorough and well thought from the beginning.

Decision fatigue is the mental exhaustion that results from making too many decisions in a short period. Already now my guess is that you see where this is going?
As you make more decisions during a day, your ability to weigh options and make sound choices simply diminishes. This can lead to poorer judgment, impulsive decisions, and even a tendency to avoid making decisions altogether.

In our field of cybersecurity, where constant decision-making is the norm, decision fatigue can undermine your ability to respond effectively to threats, leading to increased risk for your organization. Therefore recognizing and managing decision fatigue is crucial for maintaining a strong security posture and this is why I wrote this blogpost.
- [The Action Bias: Why Doing Something Isn’t Always Better Than Doing Nothing in Cybersecurity](https://securebychoice.com/blog/99470-the-action-bias) by Sarah Aalborg (Aug 4, 2024): Understanding Action Bias in Cybersecurity: Risks and Mitigation Strategies
In the high-stakes world of cybersecurity, action bias can lead professionals to make hasty decisions in response to threats. This blog post explores the concept of action bias, highlighting how it can result in rushed and risky responses, recurring problems, overcompensation, and disjointed crisis management. The post provides practical strategies for mitigating action bias, such as establishing assessment procedures, conducting root cause analysis, balancing short-term and long-term strategies, regularly assessing security measures, and developing comprehensive incident response plans. By addressing action bias, cybersecurity teams can enhance their responses, improve security measures, and build a more resilient security environment.

For more insights and detailed strategies, read the full blog post on Secure by Choice.

- [Avoid being biased in revewing your vendors ](https://securebychoice.com/blog/98979-avoid-being-biased-in-your-choice-of-vendors) by Sarah Aalborg (Jul 15, 2024)
- [Storytelling – All Power to the Hormones](https://securebychoice.com/blog/98978-storytelling-all-power-to-the-hormones) by Sarah Aalborg (Jun 27, 2024)
- [Simple Secure](https://securebychoice.com/blog/98221-simple-secure) by Sarah Aalborg (Jun 3, 2024)
- [Can you make IT Security Personal?](https://securebychoice.com/blog/98212-can-you-make-it-security-personal) by Sarah Aalborg (May 19, 2024)
- [Continuity Bias ](https://securebychoice.com/blog/97540-continuity-bias) by Sarah Aalborg (Apr 28, 2024)
- [Do you let recent events affect your judgement when risk evaluating?](https://securebychoice.com/blog/96481-do-you-let-recent-events-affect-your) by Sarah Aalborg (Mar 23, 2024)
- [The Curse of Security Knowledge](https://securebychoice.com/blog/96480-the-curse-of-security-knowledge) by Sarah Aalborg (Mar 23, 2024)
- [Do you ever worry about having secured yourself and your organization enough?](https://securebychoice.com/blog/96479-do-you-ever-worry-about-having-secured) by Sarah Aalborg (Mar 23, 2024)
- [Confident much?](https://securebychoice.com/blog/96476-confident-much) by Sarah Aalborg (Mar 23, 2024)
- [Why are we so hard to convince?](https://securebychoice.com/blog/96475-why-are-we-so-hard-to-convince) by Sarah Aalborg (Mar 23, 2024)
- [Social Proof](https://securebychoice.com/blog/96387-social-proof) by Sarah Aalborg (Mar 21, 2024)
- [What can you learn from IKEA and cake mixes when working with Governance and Compliance?](https://securebychoice.com/blog/95530-what-can-you-learn-from-ikea-and-cake) by Sarah Aalborg (Mar 20, 2024)
- [Do you know the story about the monkey and the icecream?](https://securebychoice.com/blog/95529-do-you-know-the-story-about-the-monkey) by Sarah Aalborg (Mar 20, 2024)

## Products

- [Online forløb Masterclass i IT-sikkerhedskultur](https://securebychoice.com/products/243203-Online-forloeb-Masterclass-i-IT)
- [Fra Lovkrav til lærring ](https://securebychoice.com/products/231955-Fra-Lovkrav-til-laerring)
- [Det sikre valg ](https://securebychoice.com/products/249222-Det-sikre-valg)
- [Security awareness toolkit](https://securebychoice.com/toolkit)
- [Fra awareneness til adfærd ](https://securebychoice.com/products/257411-Fra-awareneness-til-adfaerd)