RopesTalk · Ropes & Gray LLP

Culture & Compliance Chronicles: The Human Factor—Psychology and Cybersecurity in the Digital Age with Sarah Zheng

March 18, 2026·34 min·2 clips

Why do teenage boys become hackers, seeking thrills and community in online forums?

1. RopesTalk's Culture and Compliance Chronicles hosts Nitish Appadhyay, Amanda Raad, and Richard Bistrong interview neuropsychologist Sarah Zheng on the psychology of cybersecurity. 2. Zheng is a researcher at UCL's Dawes Centre for Future Crimes and co-author of 'The Psychology of Cyber Security,' with a background spanning neuroscience, IT, and data science. 3. The episode's core thesis is that cybersecurity failures are primarily behavioural and psychological rather than technical, and that organisations must redesign their defensive approaches accordingly. 4. Zheng describes how teenage boys constitute the majority of early-stage hackers, driven by boredom, loneliness, and the community identity found in online hacker forums. 5. A 19-year-old and two associates in their early 20s stole approximately $240 million in Bitcoin and were caught after flaunting their wealth on social media, illustrating how young attackers now conduct sophisticated financial crimes. 6. Zheng explains the brain's context-matching mechanism: an email appearing to come from a manager requesting a plausible task is acted upon before recipients consciously evaluate technical security indicators. 7. Social engineers exploit Cialdini's six principles of persuasion — including urgency and authority — to manufacture context that makes fraudulent requests feel legitimate. 8. Stress and time pressure compound vulnerability because cognitive load reduces the attention available to detect off-brand logos, unusual sender addresses, or other security signals. 9. A study Zheng references found that people click phishing links partly out of curiosity — wanting to verify whether something is a scam — which means click rates alone are a poor metric of actual compromise. 10. A British engineering company's Hong Kong employee transferred approximately £25 million after a Zoom call where the CFO was replaced by a deepfake video, a case Zheng identifies as an early preview of normalised AI-powered fraud. 11. Zheng's current research into social robots and AI agents examines how autonomous systems in customer service, law enforcement, and public spaces could themselves be hacked and weaponised for social engineering at scale. 12. Zheng critiques cookie-cutter compliance training — a single annual 30-minute online module — as ineffective and argues it should be replaced with contextual nudges embedded in email, Teams, and phone interfaces. 13. She references 25 situational crime prevention methods historically used by police to prevent traditional crime and proposes their systematic application in digital organisational contexts. 14. In the adversarial training study, employees viewed a video of a hacker designing a targeted phishing attack using harvested social media data, then created their own phishing scenarios before being tested two weeks later. 15. The adversarial training group clicked phishing simulation links nearly three times less than the conventional training group, though Zheng cautions the result was not statistically significant due to small sample sizes. 16. Zheng argues that shame prevents employees from reporting suspected compromise and advocates for a blameless post-mortem culture — analysing what went wrong after a cyber incident rather than assigning individual blame. 17. The interview is conversational and question-driven, with hosts sharing personal anecdotes including a diverted pharmacy call, a double-FBI scam, and an AI voice cloning attempt on a relative. 18. Zheng's answers are measured and research-grounded, occasionally caveating claims with sample-size limitations and acknowledging open questions in the field. 19. Professionals in compliance, HR, IT security, and risk management who want a behaviour-science lens on employee cyber training. 20. Listeners seeking technical cybersecurity detail, penetration testing guidance, or step-by-step IT controls will find this episode too conceptual.

As heard by us

A human-first warning about scams, social engineering, and why ordinary moments deserve scrutiny.

The piece treats cyber fraud as a people problem as much as a technical one. Sarah Zellweger links phishing, fraud, and social engineering to real financial and psychological harm, and it is strongest when it shows how loneliness and trust can be used against people.

Read the full review in PlayNext →

Why you'd press play

For when you want a clear-eyed guide to scams that feel routine.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from RopesTalk