Rhythm and Results: Shaping Security Behavior through Spaced Microlearning

Wednesday, October 14, 2026 | 11:15AM–11:55AM ET
Session Type: Breakout Session
Delivery Format: Live Session
Annual "compliance marathons" treat end users as liabilities to be managed, eroding buy-in and failing to change behavior. At WashU, we’re flipping the script—reframing faculty, staff, and students not as vulnerabilities, but as a distributed network of informed security champions. To move this vision into practice, the Office of Information Security (OIS) partnered with faculty to empirically investigate the efficacy of our custom-built microlearning curriculum and its impact on objective behavioral outcomes. While microlearning is an emerging trend, the optimal strategy remains an open question. We examine how the cadence of microlearning assignments affects cybersecurity outcomes. Our longitudinal study of over 2,500 WashU Community members examines whether the timing of the delivery — monthly, bimonthly, or quarterly, and duration— 5, 10 or 15 minutes— affects phishing-proneness compared to an annual baseline. Early data suggests a strong correlation between more frequent, shorter (e.g., 5 minutes monthly, or 10 minutes bimonthly) and reduced susceptibility to phishing simulations, challenging the status quo of annual training delivery. In this session, we share our multifaceted program, discuss empirical results, and let attendees experience a microlearning unit firsthand. Discover how the “rhythm of learning” can turn a compliance checkbox into digital empowerment at an R1 university and medical school.

Presenters

  • Chris Mondy

    Lecturer, Washington University in St. Louis

  • Christina Pomianek-Smith

    Information Security Analyst, Washington University in St. Louis

  • Madeline Quigley

    Cybersecurity Awareness and Culture Specialist, Washington University in St. Louis

  • Roselyn Rozario

    Security Awareness, Behavior, & Culture Analyst II, Washington University in St. Louis

  • Quint Smith

    Manager, Information Security Awareness, Behavior, and Culture Program, Washington University in St. Louis