packets.build00 Kite Club · Human risk management
Human risk management starts with people who stop and think
Kite Club is gamified awareness training that makes employees stop and think about the choices they make at work. Its anonymous golden questions show what they really do.
Golden spools00
01 Summary
In short
- 01Human risk management is about the risk that comes from how people behave, not about who finished a course.
- 02Mandatory training measures activity. It does not show what people do day to day.
- 03Kite Club is gamified awareness training. A short game puts everyday decisions in front of employees and makes them think.
- 04Its golden questions have no right answer and no name attached, so the answers show real habits and the gap between knowing and doing.
- 05Closing that gap means making the right path the easy one.
02 Human risk
Human risk is the risk in how people actually work
Human risk management is the practice of understanding and reducing the risk that comes from the way people behave: the shortcut taken before a deadline, the rule switched off for one day, the link opened out of habit. It is a different question from whether everyone completed the yearly course.
People are still involved in the most frequent causes of incidents. Verizon’s 2026 Data Breach Investigations Report says they continue to heavily involve the human element, including social engineering, phishing, and stolen credentials (Verizon DBIR).
03 What a course proves
A completed course just proves it was completed
Mandatory awareness training is built to be passed. There is a right answer, a pass mark and a completion rate for the audit file. Completion and click rates count activity. They do not show whether anyone behaves differently afterwards.
People also learn the answer that is expected, so the results show what they can recite, not what they do out of habit, convenience or trust when nobody is checking. A risk you cannot see is a risk you cannot manage.
04 The pause
Kite Club gets people thinking
Kite Club is gamified awareness training. Instead of a lecture, an employee flies a kite for a minute or two and meets small decisions along the way: who should have access, which supplier to trust, how to use AI with clear limits, what to do when something goes wrong. The right answers earn badges. The point is the pause. A game makes people stop and think about a choice they usually make on autopilot, and a flight takes only a minute or two.
- 01
Who should have access?
- 02
Which supplier do you trust?
- 03
How do you use AI, with clear limits?
- 04
What do you do when something goes wrong?
That thinking is where behaviour change begins. It does not finish there. A game alone does not change habits, and we do not claim it does.
05 Golden questions
Remove the incentive to look good and the answers change
Between the scored questions, golden spools ask what you would really do. For example: Most of us click through the yearly security training without really doing it. True for your team, yes or no? Or: your CEO says two-step sign-in slows them down on the road and asks you to switch it off. What do you do?
Switching it off for a week may even be a reasonable call. The gap opens when nobody writes it down as a decision: no owner, no end date, and a risk that sits in someone’s head instead of a risk register. Another golden question asks whether a safety rule switched off “just for today” has stayed off for more than a week. When it has, that is a policy exception nobody is tracking.
There is no right answer to give here, and nobody sees a name or a company next to yours, so there is no one to impress. With nothing to gain from the careful answer, people tell us what happens. It works like an anonymous survey, and it gives you a baseline: the ground truth about how work is done, shortcuts included.
Most of us click through the yearly security training without really doing it. True for your team, yes or no?
- Your CEO says two-step sign-in slows them down on the road and asks you to switch it off. What do you do?
- Has a safety rule switched off “just for today” stayed off for more than a week?
Knowing next to doing, topic by topic
Access and identity
Awareness and phishing
Suppliers and partners
Put the golden answers next to the scored ones, topic by topic, and the gap between knowing and doing shows up. The counts feed a public Insights page.
Fair warning: our players are whoever felt like flying a kite today, so read the gaps as conversation starters, not a census.
06 The easy path
The right path is not always the easy path
That is why people skip it. For security to work in a real company, the right path also has to be the easy path, because people take the easy one. The gaps show where it isn’t yet, and that is where human risk is worth managing first.
07 The boundary
Where Kite Club ends and a program begins
Kite Club is a start, not proof. It is not a certification, a training record or audit evidence. It gets people thinking and shows where to look.
Changing behaviour takes more than a game. The gaps Kite Club shows need an owner and a plan, and the work has to be tracked until the easy path and the right path are the same. Incidents and recovery are part of that too, as an operating program. That is the job packets does.
08 How a flight works
How a flight works
You steer a kite through five chapters. Each flight is about one to two minutes. Right answers to the scored questions earn badges. The golden questions earn the same points whatever you answer, and nothing you say is linked to your name or company.
Chapter 1
Lift
Trust before takeoff. Your first customers start asking harder questions.
Chapter 2
Grip
Trust holds the line. A growing team and more suppliers.
Chapter 3
Soar
Fly high, stay grounded. Enterprise reviews and AI.
Chapter 4
Hold
Built for the hard moments. Incidents and recovery.
Chapter 5
Scale
Scale with confidence. Many products, teams and markets.
The badges cover ten everyday areas of work:
- Access and identity
- Awareness and phishing
- Devices and remote work
- Data and privacy
- Suppliers and partners
- Incidents and recovery
- Change and releases
- Evidence and assurance
- AI governance
- Ownership and risk
09 Try it
Try it: a minute or two, no account
Fly a kite, collect what you learn, and answer one question honestly: what do you really do when no one is checking? Some questions have a right answer. The golden ones don’t, and they carry no name, so the truth is safe to tell.
It runs in a browser, on a phone or a laptop.