The TL;DR
- We borrowed from adtech to build Fable
- It’s about the right message to the right person at the right time
- Personalize based on behavior and context
- Deliver interventions in the moment
- Optimize for tone, timing, and channel
- Embrace experimentation
When the dust settled on the Change Healthcare attack, we learned that the breach started with a remote access portal that had no MFA enabled. A simple human action to enable MFA on remote access portals could have prevented this massive breach.
Change Healthcare was not the only organization that struggled with getting people to take the right security action. In fact, changing security behavior has a notorious reputation of being nearly impossible among security professionals. The thing though, is that behavior change is a honed science in fields like Adtech. Under the hood, the fields share the same goal: getting the right message to the right person at the right time, in a way that actually drives behavior. And this is why we started Fable. If we can get someone to buy a pair of shoes, we can get them to secure their account.
At Fable, we’re building a modern human risk platform—and we’ve borrowed liberally from our years of experience working in high-scale, high-performance adtech companies. Here’s what we’re doing to make our platform super-effective:
Let’s start with personalization. In adtech, platforms analyze browsing behavior, purchase history, and any other contextual tidbits they can learn to figure out what to show you—and when. In security, the stakes are higher (don’t tell advertisers that!), but the logic still applies. If someone has engaged in insecure behavior—admins sharing passwords, an executive reusing login credentials, a money-handler answering the call of a fake vendor, an employee forwarding work documents to their personal account, or simply someone missing important software updates—that’s the kind of behavior signal we want to act on. And the more specific and contextual, the better.
Adtech also taught us how to think about timing, frequency, and attention. In advertising, you wouldn’t show someone five ads in 30 seconds and expect them to retain and act on the information. But that’s just what the security industry has been doing for decades with its once-a-year awareness training. Ebbinghaus’s work on the forgetting curve describes an exponential loss of knowledge after learning, where people retain only about a fourth of what they learn after just one week. Those poor folks who underwent security awareness training last January—they don’t stand a chance! And we wonder why human error still accounts for 60% of cyber attacks.
At Fable, we’re borrowing from adtech’s wisdom and being judicious about when and how often we deliver our AI-generated interventions, like nudges, video briefings, and two-way chats. We know they’re most effective when sent in the moment—precisely when the risky behavior is occurring. Not only are they timed right for the recipient on the first occurrence, but they are reinforced until it becomes a new habit.
Beyond intervening in problematic behavior on a just-in-time basis, we also study when people are generally most likely to engage with our training—what time of day, over what communication channel, and even based on what message we send or tone we use—and we’re using that data to shape and optimize our interventions so they totally land. And they do. Our customers are seeing massive behavior change because of the work we’re doing together. It turns out one size doesn’t fit all. Who knew? Oh yeah, advertisers.
Finally, we brought with us one of the most powerful habits from adtech: experimentation. In the ads world, everything is tested: subject lines, image formats, message length, emoji usage, delivery cadence. And at Fable, we’ve built experimentation directly into our platform and culture. We test what grabs attention, what drives engagement, what sustains behavior change, and what quietly fails. Heck, we even experiment with which restaurants to order our team lunches! We treat every data point as a chance to learn—and get better.
The result is a human risk platform that doesn’t just throw security messages at people. It adapts, iterates, and optimizes—just like the best-performing systems in adtech. Because changing behavior isn’t about telling people what to do. It’s about understanding what works, and doing it smarter each time.
