Cyberattacks are getting smarter, faster and harder to spot. And while it’s tempting to think of cybersecurity as an IT problem, most breaches still start with people – a convincing email, a reused password, a link clicked in a hurry. That’s exactly why cybersecurity for HR, L&D and people leaders is so important – they’ve got a key part to play.

We sat down with Neil Frost, CEO of Bob’s Business – a Staff Skills academy+ partner – to talk all things cybersecurity, ahead of our free masterclass on Wednesday 18 November. Neil’s career has been built on helping people stay safe. He’s had 18 years of senior leadership experience across government departments including HMRC, HM Treasury and DCMS, leading security education and awareness, plus 15 years heading up law enforcement safety training. For the last three years, he’s focused on cybersecurity.

We asked what drew him to the field, what’s changing in the threat landscape and what you can do right now to help keep your teams safe.

Nine questions with Neil Frost

1. How did you first get into cybersecurity?

It wasn’t a traditional tech route. Early on, I saw how much time and money companies were throwing at software, firewalls and complex IT systems, yet data breaches were still happening simply because someone clicked a link in a hurry. I realised the missing piece was the human element. That sparked my fascination with the psychology of security – I wanted to figure out how to empower people and change behaviours rather than endlessly patching software.

2. Tell us about Bob’s Business. What problem are you setting out to solve?

We’re on a mission to demystify cybersecurity. Over the last 15+ years, we’ve helped hundreds of organisations and trained well over a million people. The core problem we solve is bridging the gap between technical jargon and everyday human behaviour. Security has traditionally been quite intimidating, so we set out to make it relatable and engaging. We want people to protect their organisation because they choose to, rather than feeling like security is just another frustrating hurdle in their workday.

3. What’s something about cybersecurity that most people get wrong?

The biggest myth is that it’s purely an IT problem. People tend to think, “The IT team installed antivirus, so I don’t need to worry.” The reality is that your firewall can be world-class, but if a well-meaning staff member hands over their login details to a convincing phishing email, technology can’t save you. Another big misconception is small businesses thinking they aren’t targets. To an automated bot, data is data, and everyone is a target.

4. How have cyber threats changed over the last few years?

When I first started in the industry, threats were quite crude – badly spelt emails offering millions. Today, the sophistication and scale are industrial and highly organised. A classic example is CEO fraud: attackers study an organisation’s structure on LinkedIn, learn how the leadership team speaks and send a perfectly timed message to the finance team asking for an urgent transfer. It’s no longer just a numbers game; it’s targeted social engineering.

🛡️ Cybersecurity masterclass: turn your team into your first line of defence
📅 Wednesday 18 November 2026, 9:30–10:30am GMT.
Join Staff Skills academy+ and Neil Frost, CEO of Bob’s Business, for this free masterclass. Plus, earn 1 CPD credit.
Register now to save your spot

5. What role is AI playing for attackers and defenders?

It’s a double-edged sword. For attackers, AI is a massive accelerator that removes language barriers – the clumsy phishing emails of old are now flawless and persuasive. We’re also seeing deepfake audio and video used to bypass verification. On the defence side, AI excels at pattern recognition, helping us spot anomalies and shut down attacks before they spread, much faster than a human could.

6. What kinds of attacks should organisations be most worried about right now?

The top two to watch out for are sophisticated phishing – which often acts as the gateway for ransomware – and business email compromise (BEC). Phishing remains the primary way attackers get access. BEC occurs when an attacker gains access to a legitimate email account to send fraudulent invoices or intercept payments. Both rely heavily on tricking people rather than hacking systems.

7. Why does cybersecurity for HR, L&D and people leaders matter so much?

Cybersecurity is fundamentally about behaviour and culture, and nobody understands people better than HR and L&D. To create a secure organisation, you need to build a culture where people feel safe reporting mistakes, where onboarding instils good habits from day one and where training is engaging. As the architects of company culture, you’re best placed to weave security into its fabric and protect your teams.

8. What makes security awareness training actually stick?

We have to ditch the annual tick-box exercise. A long, dry presentation once a year does nothing to change behaviour. Training sticks when it’s frequent, concise and highly relevant. At Bob’s Business, we use storytelling, animation and relatable scenarios. If training feels like a useful life skill – one people can use at home to protect their families and personal finances – you win them over.

9. If people could do one thing this week to protect their organisation, what should it be?

Turn on multi-factor authentication (MFA) for all important accounts. It costs nothing, requires no technical knowledge and blocks the vast majority of automated attacks. Even if someone steals your password, MFA makes it far harder for them to get in.

We’ll be diving deeper into practical, non-technical strategies in our upcoming masterclass tailored for people leaders. We’ll skip the IT jargon and focus on building a secure culture with actionable steps you can implement straight away. I’m looking forward to seeing you there.

A huge thank you to Neil for sharing his insights. If there’s one thing to take away, it’s that cybersecurity isn’t just a job for IT – it’s a people issue. And that’s where you come in.

Want to learn more?

Join Neil and the Staff Skills academy+ team for our free, one-hour cybersecurity masterclass on Wednesday 18 November 2026 at 9:30am GMT. It’s designed for HR, L&D and people leaders, and you’ll leave with practical steps to help your teams spot threats and stay safe.

The event is accredited by The CPD Group, so attending earns you 1 CPD credit and a free CPD certificate.

In the meantime, if you’d like to explore the Bob’s Business cybersecurity courses on the Staff Skills academy+ platform, why not sign up for a 14-day free trial?