There is a type of dad most security practitioners recognize. The one who checked the locks before bed, kept the spare key inside the house, and told you to hang up if a stranger ever asked for personal information over the phone. He was not in the field. He did not have a framework. He had a mental model built to protect the people he loved, and he ran it without fail.
What happened over the next twenty years is the story the field rarely tells.
In the early days, the threats were physical and the rules were clear. Don't open the door for strangers. Don't tell people what you have. Don't share your address with someone you just met. Don't wander somewhere alone without telling someone where you were going. These rules made sense because the threat was visible. It had a face. It came from outside the house and usually had to get past the front door first.
Then the front door moved.
By the mid-nineties, a different kind of stranger could reach your kids without knocking. Dial-up connections and chat rooms meant the perimeter your dad had spent years fortifying now had a gap he hadn't planned for. The same man who checked the locks before bed found himself trying to understand something he had not grown up with, in order to protect people he would do anything for. Some dads waved it off. Others leaned in. The ones who leaned in started applying the same logic they always had. Who is this person? What do they want? Why are they being so friendly so fast? Don't give them more than they need to know.
The rules updated. The instinct didn't.
Social media arrived and expanded the surface area again. Now the threat wasn't just a stranger in a chat room. It was a photo that showed too much. A post that announced the family was away for two weeks. A location tag on a beach picture that told anyone paying attention exactly where to find your daughter every Saturday morning. Dads who were paying attention started asking new questions out loud. Why does this app need to know where you are? Who can see this? What happens to this after you post it?
These were not tech questions. They were the same questions their own fathers had asked about the neighborhood, about the people who came to the door, about what you said to strangers. The context had changed. The underlying concern had not.
Smartphones made it harder. The surface area exploded. Every app was a potential entry point. Every platform was a new venue where someone could reach your kid, manipulate your kid, learn things about your kid that they had no business knowing. The dads who kept up weren't running a security program. They were doing what they had always done. Paying attention. Asking questions. Adjusting the rules when the threat changed shape.
Some of those conversations were uncomfortable. Why can't I have this app? Why do you need to know my password? Why does it matter who I'm talking to? The dads who had those conversations anyway, who held the line not out of paranoia but out of genuine understanding of what was at stake, were doing something the security field has spent decades trying to replicate inside organizations. They were building a culture of care around something that was changing faster than anyone could fully track.
That is what made it hard and what made it matter.
The mental model those dads were running across two decades is what the field now calls risk management. Identify your assets. Know your threats. Minimize exposure. Verify before trust. Monitor what you can and respond fast when something looks wrong. This is what security programs are designed to build into organizations. It is also what certain fathers figured out on the fly, with no training and no budget, because the alternative was unacceptable.
The difference between those dads and most corporate security awareness programs is stakes. The dad warning his teenager about location sharing was not running a compliance exercise. He was protecting a specific person who mattered more than anything. That urgency changes how the message lands. It changes whether the behavior sticks.
Most security practitioners who have tried to build genuine security culture inside an organization know the gap. You can train people. You can run simulations. You can write the policy. Most employees will still treat security as something that happens around them, not something they do. The practitioners who carry the instinct natively almost always trace it back further than their first job. Back to a person who made the threat feel real before it became abstract.
For the practitioners reading this, take a moment today to trace the mental model. Where did it start? Maybe it started with a dad who checked the locks. Maybe it evolved with a dad who learned enough about the internet to ask the right questions about it. Maybe it came from somewhere else entirely, a manager who took a breach personally, an incident that changed how you think, a moment when the stakes stopped being theoretical.
The point is not where it came from. The point is that it came from somewhere real, and it can travel forward from you.
The fathers who navigated twenty years of shifting threats were not security professionals. They were people who refused to let the threat outrun their attention. Every time the surface area expanded, they expanded with it. Every time a new platform appeared, they learned enough to ask the right questions. Every time their kids pushed back, they held the line anyway.
That is still the job. Whether you run a security program for ten thousand users or you are the person in your house who checks the locks and asks who your kid is talking to online, the underlying principle stays the same. Build the habit, explain the why once, and make the careful thing the obvious thing to do.