A PIN code on a restaurant’s allergen tablet. A phishing simulation that caught the person who designed it. A Where’s Wally picture used to explain what it takes to find one threat among 80,000 stadium fans. The five UK cyber leaders below use stories like these to make the same point: security only works when people understand it and can act on it. They range from specialists running awareness programmes to a CISO briefing a FTSE 250 board, and each has a different way of making security fit the people it is meant to protect.
Stu Walton – Security Awareness Specialist, Pinsent Masons
On a day out with his wife, Stu Walton became, in his own words, a hacker. A restaurant handed them a tablet to check allergen information for his dietary requirements, it locked itself while he stepped away, and rather than wait for a busy manager, he typed in the PIN he had watched them enter. He turned the moment into two lessons: a slightly longer PIN is still easy to guess, and locking a device that only displays an allergen menu may be security for security’s sake. “Security measures work best when they make sense for the environment and the people they are trying to protect,” he wrote. That outlook shapes his role as Security Awareness Specialist at law firm Pinsent Masons, which he joined in March 2025. He came from nearly a decade at Newman University Birmingham, rising from audio-visual technician to IT support manager, stepping in as interim head of IT services between directors, and finishing as deputy director of digital and IT. He is listed to speak at IMPACT UK in March 2027.
Emmanuella Hagan – People Centred Security Specialist, Sage
“Good security doesn’t come from telling people what not to do but from helping them understand why it matters, in a language that actually lands.” That belief guides Emmanuella Hagan in her work at Sage, where she has led and supported people-centred security programmes for more than 11,000 colleagues worldwide since May 2024. From Newcastle, she runs company-wide training and awareness, designs tailored learning for technical teams such as developers and architects, works closely with Sage’s Security Champions community across technology and engineering, and partners with internal communications to keep security visible. She also represents Sage externally with industry partners, professional bodies and government. Her route in was, as she puts it, a little unconventional: a first-class computing degree in security, forensics and networks, GRC consulting, and time at King’s College Hospital, including managing data for the hospital’s staff COVID-19 vaccination programme, before a growing interest in behavioural science brought her to her current role.
Holly-Jane Grayling – Director of SHIELD (Volunteer), Cognitive Security Institute
Even the people who design phishing simulations can fall for them. Holly-Jane Grayling has talked openly about being caught by one of her own, and about why human context matters more than blame. She has spent more than six years specialising in human cyber risk, leading security culture and awareness at Tunstall Healthcare until September 2026, after roles at WPP and Aviva. Since March 2026 she has volunteered as Director of SHIELD, the Cognitive Security Institute’s human risk programme, leading its global community, events and workshops. Its projects include AI Cognitive Defence, which develops practical frameworks and free resources to help organisations handle the human side of AI adoption, and the Human Risk Decision System, a model for moving beyond awareness activity towards contextual, evidence-led decisions about human risk. Her path into security began well outside it, in graphic design and learning design, and she has written a published article, “The Risk Manager’s Guide to Cyber Awareness.”
John Cruise – CISO, Mitie
At Mitie, around half of John Cruise’s job is commercial. As CISO since June 2022, he leads customer security assurance across bids, tenders and contracts, alongside cyber strategy, risk and resilience for a £5.6 billion business with 80,000 colleagues delivering critical services across government, defence, healthcare and national infrastructure. He advises the board and its audit and risk committee and has reframed board reporting around exposure, operational consequences and the decisions required. He expects his teams to explain risk in plain language, and in a 2026 interview credited them with bringing “clarity rather than noise” by translating technical issues into business impact. Under his leadership, Mitie established a 24/7 Cyber Defence Centre and moved more than 40,000 colleagues to passwordless authentication. He rose through Mitie from head of infrastructure and networks to head of information security before taking the CISO role, and was named CISO/CSO of the Year at Computing’s Security Excellence Awards in 2026.
Kam Karaji – Director Cybersecurity & Risk Management, NFL
In policing, Kam Karaji was taught not to chase the “red mist,” the tunnel vision that comes from fixating on one suspect and missing what is happening around you. He now applies that lesson to AI. A single alert, he has said, can narrow a team’s focus while the real risk sits elsewhere, so humans need to review AI outputs in context and know clearly when to escalate, contain or stand down. As Director of Cybersecurity and Risk Management at the National Football League since November 2024, he addresses the cyber risks of the league’s international games, from stadium operations to deepfakes targeting players and officials. He has described an AI governance process in which clubs apply to use AI tools and a panel from legal, finance, business operations and security reviews each request. He brings an unusual background: more than 13 years with Leicestershire Police, including as a counter-terrorism specialist firearms officer and bronze commander, followed by senior security roles at National Grid and Barclays and two years as CISO of Bibby Financial Services.
Five Ways to Say It Plainly
Walton wants measures that make sense for the people they protect. Hagan looks for language that lands. Grayling puts human context ahead of blame, Cruise asks his teams to explain risk in plain language, and Karaji keeps a human reviewing what the machines flag. Their titles and organisations differ, but their message is the same: people are part of the defence, not just the risk.
Discover more CISOs securing their organizations:
-
- Beyond Awareness: The Nordic CISOs Making Secure Behavior Part of Everyday Work
- Going the Distance: The Marathon-Running CISOs to Watch
- Beyond the Office Network: Australia’s Operational Cyber Leaders to Watch
- From Molecule to Pharmacy: The Swiss CISOs Securing the Medicine Supply
- Shared Defence: Cybersecurity Leaders Protecting Research and Education
John Kevin Hao is a news and feature writer covering cybersecurity, technology, and business targeted for professional audiences.