I went bowling the other day. There are still bowling alleys around. I\u2019ve not been bowling in a very long time. It\u2019s one of those things that seems to have fallen off in popularity at some point. I\u2019m told it\u2019s coming back and becoming more popular. We\u2019ll see I suppose, I think it\u2019s still fun.The point of this post isn\u2019t to dwell on bowling though, it\u2019s to focus on human behavior. Being a security person, I managed to see a security story in the events of my bowling \u2026 game? match? I have no idea what it\u2019s called.I was bowling because one of my kids were part of a group that planned a family bowling event. Most of the kids had bumper rails put up on the alley they were using. The idea of the bumper rails is to keep the ball out of the gutter. They are literally rails on the side of the lane you throw the ball down.Being a stodgy old person, I insisted we bowl the first game without any rails up. This caused a great deal of wailing and gnashing of teeth from the youngsters. They did manage to make it through the game with only minimal long term emotional damage I think.They did really well actually. They didn\u2019t need the bumper rails, they could bowl just fine. However as soon as the first game was done they made sure the bumper rails got put up by the nice people who run the bowling alley. They apparently had enough danger for one day.Here\u2019s where we get into the behavior part. I don\u2019t think it would surprise anyone to learn with the bumper rails installed the kids screwed around. A lot. They hit the rails constantly with their balls, sometimes on purpose. These were not the same people who had bowled the previous game.This got me wondering. Why did the behavior change so drastically? I have a suspicion a lot of it was caused by the fact that these people knew with the rails installed they didn\u2019t have to care as much, so they didn\u2019t.This change in behavior isn\u2019t surprising if you think about it. If people know they\u2019re safe they can afford to goof off more than if they\u2019re not safe. The definition of safe is relative of course. Being \u201csafe\u201d during a game of bowling is nothing like being safe in the middle of a riot.I want to extend this to awareness training. It\u2019s no secret I\u2019m not a fan of awareness training. I\u2019ve never seen a single statistic that shows it works (and I\u2019ve looked quite a lot). There are a number of things we do in security not because it works but because cargo cult mentality tells us we need to do it.Since awareness training doesn\u2019t work, what might work is something I\u2019m going to call understanding training. What if rather than obsessing about the impossible task of teaching someone which links are safe to click on. What if we try to make them understand the landscape they exist in. Where are their rails?Keeping with bowling, here is how I explain it.Awareness training is telling someone they need to throw the ball down the middle of the lane and knock over the pins. Knock over as many pins as you can. Make sure the ball doesn\u2019t go in the gutter. Not every bowling lane has bumper rails, so let\u2019s just not worry about explaining those.Understanding is when you know how the mechanics of the ball, pins, and lane work. You understand that if rails are up, the threat of a gutter ball goes away. You know you can bounce the ball off the rails if you need to. You will probably have a higher score; not because you\u2019re a better bowler but because you can use technology to improve your score.Awareness training puts a lot of focus on specific situations and expected outcomes. Awareness training puts the responsibility on the human to do the right thing. Humans never consistently do the right thing. We\u2019ve all taken training like this, it\u2019s generally not enjoyed and given current state of security, it doesn\u2019t work very well.Understanding shifts the focus from the human to the technology. Technology is generally consistent. But understanding is very context dependant which makes it tricky. Your ability to react to certain situations is unique to you and your organization. It\u2019s not going to be possible to find an off the shelf training module in an instance like this. Sometimes it\u2019s all about technology, sometimes it\u2019s just knowing where the technology falls short.I don\u2019t have data today, so take all this with a grain of salt. I do hope to put some effort into proving this right or wrong, without data you don\u2019t really know if something is a good idea or a bad idea. I have a suspicion any organization would benefit from better understanding no matter what the topic is. Awareness isn\u2019t enough, we need to look at our problems in a new way.