Stop Blaming Bob in Accounting: What Ethical Hacker Glenn Wilkinson Would Change | Cyber Answered

Don't click links. Change your password every 90 days. Run another phishing simulation. Glenn Wilkinson argues that two of security's most repeated pieces of advice are actively making things worse, and that shouting at Bob in accounting for clicking a link, when clicking links is his job, is security passing the buck. In this Cyber Answered conversation, Glenn takes ten questions on the hacker mindset, social engineering, security awareness training and what he would replace the old advice with. Glenn is an ethical hacker, keynote speaker and CEO and co-founder of Agger Labs, which builds endpoint software to stop ransomware before encryption starts. He has legally broken into more than 100 organisations, spoken at Black Hat and DEF CON, and co-created Snoopy, the wireless tracking and profiling drone framework covered by the BBC and CNN. He is a Rhodes Scholar with two master's degrees from Oxford. Host Vasileios Kospanos puts the questions, plus a bonus one left by the previous guest, Ryan Sheldrake. You'll get: Why the most surprising break-ins are the trivial ones into well-defended organisations How a camera on a coffee shop table turned into physical access to a building Whether the hacker mindset can be taught, and what separates a methodical hacker from a haphazard one How to brief a board or a room of CISOs: show them the risk, then move to the strategic questions, starting with who decides during an incident Why phishing simulations don't hold up against the data, and what nudge-based awareness does instead Let passwords die: passphrases, password managers and passkeys What self-defence training teaches about incident response: under pressure people fall back on what they have drilled Social engineering: start with trust, not technology, and anticipate what the target expects to see The AI risk that worries him, which is not the AI super hacker Securing agentic AI: constrained paths, visibility and a human in the loop Timestamps 0:00 Intro: Glenn Wilkinson, ethical hacker and CEO of Agger Labs 1:07 The live demo that gets the strongest reaction: hacking a billion dollar bank 2:59 The hacker mindset: can anyone learn it? 4:19 The most surprising way into somewhere he shouldn't have been 6:12 Briefing CISOs and boards vs technical audiences 8:48 Self-defence and cyber: why you fall back on what you've drilled 11:52 The security advice that should die: 90-day passwords and "don't click links" 14:30 Why phishing simulations don't work, and what to do instead 16:55 Does the hacker mindset change by country? 19:28 Social engineering without technology: start with trust 20:57 What actually worries him about AI 22:13 What he'd really think if his own family got scammed 23:13 Bonus question: psychological safety in the age of agentic AI Links Glenn's website: glenn-wilkinson.com Agger Labs: agger-labs.com About Cyber Answered Cyber Answered is a private, invite-only network for security leaders running security under pressure. The Security Library: short video answers to your hardest problems, from CISOs and security leaders who've faced them. No vendor pitches or hour-long webinars, just practical lessons organised by problem, not product. Private security roundtables: small, off-the-record sessions with peers from similar organisations, team sizes and risk profiles. Request an invite: cyberanswered.com #EthicalHacking #SocialEngineering #PhishingSimulation #CISO #CyberSecurity