DXC Technology’s CISO on harnessing behavioural science for cyber security success

Kylie Watson, CISO at DXC Technology, discussed how behavioural science and tailored risk management approaches are critical to navigating the modern cyber security landscape.

In an interview with ADAPT’s Principal Research Analyst, Peter Hind, Kylie shared her insights on balancing internal and external responsibilities in her role as both an internal and consulting CISO.  

She spoke about the importance of using behavioural insights to create a culture of shared responsibility for security, and the evolving nature of cyber threats faced by organisations today. 

Kylie will join 150 leading CISOs & CSOs from enterprise and government organisations in to debate strategies on how to navigate the vulnerability minefield & enable the age of AI at Security Edge on 10 October. 

Understanding risk appetite and engaging stakeholders  

Kylie emphasised the need for organisations to properly assess and understand their risk appetite, using real-world scenarios such as ransomware attacks to frame these discussions.  

By linking risk to tangible impacts on the organisation, she believes stakeholders can make more informed decisions.  

This helps engage leaders without overwhelming them with technical details, fostering a collaborative approach to cyber security. 

Using behavioural science in cyber security  

Kylie applies her behavioural science background to her cyber security role, using psychological insights to influence behaviour and drive engagement.  

She sees this as essential in creating an organisational culture where security is not viewed as a burden but as a shared responsibility.  

This includes motivating teams and stakeholders by focusing on positive reinforcement rather than fear-based tactics. 

Balancing internal and consulting roles  

In her dual role, Kylie manages both DXC’s internal security and its consulting services. 

This allows her to stay ahead of emerging threats while maintaining a broad view of the security landscape across different industries.  

She highlighted how understanding the behaviour of cyber criminals can provide an edge in predicting future threats, particularly in areas such as ransomware.  

Her ability to assess risks beyond what the data might immediately reveal has helped her detect and address issues before they escalate. 

Key Takeaways: 

• Behavioural science enhances security culture: By applying psychological principles, organisations can foster a more engaged and proactive security culture. 
• Risk management must be tangible: Framing risk appetite discussions around real-world scenarios leads to more effective decision-making. 
• Calm and focused response to crises: Emotional regulation and measured communication are key during cyber security incidents, ensuring better decision-making and coordination.