The security industry's traditional approach to mitigating human risk is predicated on the assumption that individuals will make the right security decisions if they have enough training and fear of the consequences. Years of security research indicates otherwise. This briefing will share key insights from nearly a dozen security training research studies and analysis of several dozen security behavioral change campaigns to more than 65,000 employees across industries. We will show why traditional training approaches are ineffective in changing behaviors. Instead, our findings highlight techniques such as personal relevance, social proof, leveraging intrinsic motivation, and tight-feedback loops are key factors to reduce human risk. This talk will explain why these behavioral change techniques are found to be most effective. We will then share concrete examples of how security teams can leverage these techniques to effectively reduce human risks such as phishing, malware downloads, and sensitive data handling in their own organizations.