# The Hardest Security Problem Isn't Technical. The DNC Figured That Out the Hard Way.
After one of the most consequential breaches in American political history, the Democratic National Committee had to answer a question every CISO eventually faces: how do you make ordinary people actually care about security?
Their answer involved bobbleheads.
Former DNC chief security officers have been talking publicly about the organizational playbook they built after the 2016 compromise — a hack that reshaped an election cycle, triggered years of congressional hearings, and made the DNC a textbook case study in breach response. The technical post-mortems got written. The phishing forensics got done. But the harder problem, the one that doesn't get enough coverage, was cultural: how do you build a security-first mindset inside a political organization that's perpetually chaotic, staffed heavily by volunteers, runs on urgency, and switches out its entire workforce every four years?
Their answer: make security absurd enough to remember.
## The Specific Hell of Securing a Political Organization
Political organizations sit in a unique threat tier. Nation-state actors — Russian GRU, Chinese MSS, Iranian IRGC — actively prioritize them. The targets aren't just data; they're strategy documents, donor lists, opposition research, candidate communications. The 2016 DNC intrusion, attributed to Russian military intelligence, wasn't a smash-and-grab. It was a long-dwell operation. Attackers were inside for months before anyone noticed.
What makes this environment brutal for security teams is the personnel model. Unlike a corporate environment where you can mandate MFA and send the same phishing simulation quarterly until everyone clicks less, political orgs rotate staff constantly. A field organizer hired in April is gone by November. The intern who helped set up a state party office won't be there next cycle. You're not building lasting security habits in individuals — you're trying to build an institutional reflex that survives the turnover.
That's structurally different from enterprise security, and most enterprise security frameworks don't account for it.
## Why Most Security Awareness Programs Fail
Here's an uncomfortable truth the security industry doesn't dwell on: most security awareness training doesn't work. The annual compliance video that nobody watches, the phishing simulation that generates resentment instead of learning, the policy PDF that lives in a SharePoint folder nobody opens — these check a box without changing behavior.
The research on this is consistent. Organizations can measure phishing click rates all day, but click rates are a proxy, not an outcome. What actually changes behavior is sustained cultural reinforcement — and that requires making security feel like something that belongs to people, not something imposed on them.
The DNC's approach, as their former CSOs describe it, leaned hard into humor and visible absurdity. Bobmojis — custom emoji sets built around security concepts — gave staff a lightweight, low-friction way to engage with security messaging in the communication channels they already used. Bobbleheads of security team members made the abstract personal: these are real humans, not a policy document.
This isn't gimmickry for its own sake. It's behavioral design. Novelty drives attention. Humor lowers defensiveness. Personalization builds tribal identity around security rather than against it. The goal is to make "thinking about security" feel like something your people do, not something done to them.
## The Executive Dependency Problem
Every security culture initiative eventually hits the same wall: executive support.
The former DNC CSOs are explicit about this. Without leadership visibly backing security priorities — not just approving a budget line, but actually modeling the behavior, attending trainings, talking about security in all-hands — the cultural program collapses. Staff read organizational priorities from what leaders actually do, not from policy documents. If the CEO clicks the phishing link and laughs it off, so will everyone else.
This is the variable that most post-breach analysis underweights. Coverage of major incidents focuses on technical failures: the unpatched system, the stolen credential, the misconfigured cloud bucket. Those are real. But the upstream cause is usually organizational — a security team that couldn't get budget to patch, or couldn't get executive attention to enforce MFA, or couldn't get past a culture that treated security as friction.
The DNC had an advantage here that most organizations don't: an existential threat they could point to. After 2016, it wasn't hard to get executive attention. The motivating case was right there in the headlines. Most organizations don't get that clarity until after they're breached.
## What Good Actually Looks Like
The elements the DNC assembled — humor, executive modeling, persistent reinforcement, identity-building around the security team — map to what organizational psychology tells us about lasting behavior change.
A few things worth noting for anyone trying to replicate this:
Channel integration matters. Bobmojis work because they live in Slack, Signal, or wherever your people already communicate. Security awareness that exists only in a dedicated training portal will be ignored. Meet people where they are.
Make the security team human. The bobblehead detail sounds silly, but it solves a real problem: security teams are often faceless compliance enforcers. When people know who the CSO is, can laugh at a caricature of them, have a name to put to a face — they're more likely to actually report a suspicious email instead of hoping someone else handles it.
Consistency beats campaigns. A single security awareness month does almost nothing. Sustained, low-key cultural reinforcement throughout the year does. The DNC's approach was about ambient presence, not annual events.
Turnover is the enemy. This is specific to political orgs but relevant anywhere with high churn. Security culture has to be embedded in onboarding, repeatable without tribal knowledge, and documented in a way that survives the departure of the people who built it.
---
## HackWire Analysis
The DNC's security culture story is being told as a feel-good piece about bobmojis, but the more important read is what it reveals about where organizational security is failing everywhere else.
The 2016 hack was not primarily a technical failure. The phishing email that compromised John Podesta's account was not sophisticated. The credential theft that gave Russian intelligence access to DNC servers exploited human behavior, not a zero-day. The technical controls that could have stopped it — MFA, phishing-resistant authentication, basic network segmentation — existed and were available. The gap was organizational: the people with authority didn't enforce them, and the culture didn't make security everyone's job.
That's the pattern that repeats across every major politically-motivated breach since. The 2020 SolarWinds supply chain compromise succeeded in part because organizations with mature technical controls still had gaps in process and accountability. The 2022 LAPSUS$ wave burned through major tech companies not through zero-days but through social engineering and SIM swapping — attacks that require humans to make bad decisions.
What the DNC's CSOs understood — and what most enterprise security programs still haven't internalized — is that the human layer is the attack surface that scales. You can patch a CVE. You can't patch organizational apathy.
The timing of this story matters too. We're heading into another election cycle, and political organizations at every level remain high-value targets with variable security maturity. State parties, campaign committees, PACs, and voter data aggregators represent a sprawling attack surface where a DNC-style cultural investment is rare. The national committee can hire CSOs and build programs. A county campaign office running on volunteers and a $50/month cloud account cannot.
The takeaway for defenders isn't "buy bobbleheads." It's that security culture is a first-order problem deserving first-order investment — and that the organizations most at risk are often least equipped to solve it.
— HackWire Editorial
---
## Related Coverage