The Coercion Lever Your Awareness Training Never Models

Walk onto almost any security team in Las Vegas for a casino operator, a logistics hub, a regional bank, or a Fortune 500 satellite office, and you'll find a workforce that looks a lot like the city itself: Las Vegas rivals Los Angeles in ethnic diversity, and is more diverse than Seattle, Denver, Washington D.C., Phoenix, or Salt Lake City, according to WalletHub's 2025 diversity index. That rich mix is in the security operations center, on the help desk, and in the frontline employee who reports — or doesn't report — the suspicious email. Most social engineering defense assumes none of that matters. It should.

Fear isn't a universal language

Social engineering has always worked by finding the pressure point that gets someone to act before they think: a fake invoice, fake executive request or a fake deadline. What gets less attention is that which pressure point works, and how hard it works, isn't the same for everyone because our relationship to authority, institutions, and fear isn't shaped by a single, universal experience.

Consider a vishing script where the caller claims to be from HR, threatening to "escalate" an issue if the target doesn't act immediately. For one employee, that's an obvious overreach they'd laugh off or verify with a call to their manager. For another, maybe someone with a more precarious relationship to their job or institutional authority generally, that same threat can trigger a much faster, much more compliant response. A caller impersonating law enforcement plays out the same way: a nuisance to be politely stonewalled for some, but for others, shaped by very different lived experience with police or government authority, a genuine, adrenaline-spiking threat that short-circuits the skepticism your awareness training spent an hour building. This isn't a hypothetical - it's the same principle attackers have always exploited, "find the lever that works," applied to a dimension most defenders have never modeled: culture.

The blind spot in the pretext

Here's the uncomfortable part for those of us who build awareness programs: most phishing simulations, most vishing scripts, most training content is written by one team, from one cultural vantage point, and rolled out to the entire org as if everyone in it starts from the same baseline relationship to authority and fear. That's not a training-completion gap - it's a threat-modeling gap. When's the last time your simulated pretexts were reviewed for cultural assumptions the way you'd review them for technical realism? If the honest answer is never, you don't actually know your organization's real exposure: you know your exposure to one version of the workforce sitting inside your walls, not the one that's actually there.

What this looks like in practice

A few places to start, whether you're running a five-person security team or a global GRC program:

• Build cultural variation into red-team and phishing-simulation design, the same deliberate way you already build in technical variation. That includes different lures, different urgency levels, and different channels. Add different authority framings and see what actually changes in your click-through and report rates.
• Audit your existing awareness content for a single implicit "employee persona." If every example scenario assumes the same relationship to HR, law enforcement, and institutional trust, you've built a program that's only as strong as its narrowest assumption.

Why this matters beyond the SOC

I didn't arrive at this insight from a technical assessment: I arrived at it living and working in a city where the person sitting across the table - in a classroom, a conference room, or a security operations center - is as likely to have grown up speaking Spanish, Tagalog, or Vietnamese at home as English. Las Vegas doesn't just employ a diverse workforce; it produces one. That variation doesn't disappear when someone walks into a corporate badge reader - it just gets less attention.

Security has spent two decades hardening technical attack surfaces. The human one is still running on default settings. It's time we patched it.