Seguridad 360: from awareness to resilience
Physical Security + Cybersecurity + Human Factor
From awareness to resilience
Security doesn't start with a camera, a firewall or an antivirus. It starts with a human decision.
Note: the image shows the staircase “from awareness to resilience” (in Spanish). In the model, the first steps are worked on as belief (awareness of one's own responsibility) and thinking (analyzing risk before acting).
The sequence
BELIEF → THINKING → ALERTNESS → ACTION → HABIT → CULTURE → RESILIENCE
Belief
Security is my responsibility too.
Everything starts with what people believe about their role. If they think security is someone else's job, they will not see the risks right in front of them.
Physical securityDon't assume that protecting the organization is only the security staff's job.CybersecurityDon't assume that digital security is only IT's job.Thinking
Before I act, I assess the risk.
The belief becomes a question people ask themselves before deciding.
Physical securityDo I know this person trying to get in?CybersecurityWas I really expecting this email, link or file?Alertness
Conscious attention, not fear.
Developing the judgment to recognize what is unusual without living in fear or distrusting everyone. It is the “yellow” state of the color code.
Physical securityNoticing someone waiting by the door without a badge, or a vehicle stopping for no reason.CybersecurityNoticing the urgency, the strange sender or the link that doesn't match.Action
Turning knowledge into behavior.
Knowing is not enough: security is demonstrated through concrete behavior at the right moment.
Physical securityAsking for ID — reporting a suspicious situation — not allowing tailgating.CybersecurityNot clicking right away — verifying senders — reporting phishing.Habit
The safe choice becomes automatic.
Repeated actions become routines that work even under pressure or fatigue.
Physical securityClosing access points — wearing the badge — protecting documents.CybersecurityLocking the screen — using MFA — verifying sensitive requests.Culture
From the individual to the collective.
When habits are shared, people reinforce them in each other: the group corrects, reminds and recognizes.
Physical securityThe team expects everyone to wear a badge and escort their visitors.CybersecurityReporting a suspicious email is normal and appreciated.Resilience
Prevent, respond and recover.
A resilient organization is not one that never suffers incidents, but one that detects them in time, responds in an orderly way and recovers by learning.
Physical securityRehearsed emergency plans and defined owners.CybersecurityTested backups, an incident response plan and continuity.
Two dimensions
The person and the organization
Change starts with each person and is consolidated when the organization turns it into culture.
Person
- Belief
- →
- Thinking
- →
- Action
- →
- Habit
- →
- Safe behavior
Organization
- Behavior
- →
- Collective habits
- →
- Culture
- →
- Resilience
Three circles of protection
Person → Physical environment → Digital environment
The human factor is at the center because it connects both worlds.
Person — Human factor
At the center is the person. Their beliefs, judgment and habits determine whether a control works or is bypassed. The human factor connects both worlds: the same person who holds a door is the one who opens an email.
Interactive cases
What would you do?
Two real situations, two different worlds, the same tricks.
Case — 7:40 a.m.
The door and the boxes
It's 7:40 a.m. You arrive at the office and someone carrying several boxes asks you to hold the door because they forgot their badge.
What would you do?
The scene combines courtesy, urgency and distraction: classic ingredients of tailgating, entering behind an authorized person. A physical attacker doesn't need to force a door if someone opens it for them. Naming a department is not identification. The safe response is kind and firm: help without skipping access control. That same access could end in stolen equipment, a device planted on the network or access to documents.
Case — 10:15 a.m.
The urgent transfer
At 10:15 a.m. you receive a WhatsApp message apparently from the general manager urgently requesting a transfer and asking you not to call because they are in a meeting.
What would you do?
This is a typical case of impersonation and social engineering, similar to CEO fraud or BEC (Business Email Compromise). It uses the manager's authority, urgency and isolation (“don't call me”). Replying on the same channel doesn't help: it may be controlled by the attacker. The defense is independent verification, using contact details already on record, and a payment procedure nobody can skip — not even the manager.
A physical attacker and a digital one exploit the same human factors
- Trust
- Authority
- Urgency
- Curiosity
- Courtesy
- Distraction
That's why Seguridad 360 trains the same judgment for the door, the phone and the inbox.
Frequently asked questions
What is Seguridad 360?
Seguridad 360 is a practical model from CiberCEO de Hoy en Día that integrates physical security, cybersecurity and the human factor. It proposes a behavior-change sequence —belief, thinking, alertness, action, habit, culture and resilience— so that people recognize risk before it becomes an incident. It is an applied framework, not a scientifically established psychological theory.
Why should physical security and cybersecurity be integrated?
Because attackers don't respect that boundary. Physical access can end in information theft, and a digital attack can switch off cameras or open doors. Both types of attack also exploit the same human factors: trust, authority, urgency, curiosity, courtesy and distraction. Managing them separately leaves gaps.
What is social engineering?
It is manipulating people into handing over information, granting access or taking actions that benefit an attacker. It happens in person (fake technicians, tailgating), by phone, by email (phishing) or through messaging apps (executive impersonation).
Is Seguridad 360 a psychological theory?
No. It is a practical model for changing behavior and organizational culture. It draws on experience in security training and on principles widely used in awareness programs, but it does not claim to be a scientifically established theory.
Bring Seguridad 360 to your team
Open course on October 31, 2026, or an in-company program tailored to your organization.