🦄 Making great presentations more accessible.
This project aims to enhances multilingual accessibility and discoverability while maintaining the integrity of original content. Detailed transcriptions and keyframes preserve the nuances and technical insights that make each session compelling.
Overview
📖 AWS re:Invent 2025 - Lead resilient security teams through psychological safety (SEC219)
In this video, Jessie Skibbe, Principal Security Strategist at AWS, explores psychological safety in security teams, defined by Amy Edmondson as a shared belief where members feel safe to take interpersonal risks without fear of negative consequences. She explains the four-stage pyramid: inclusion, learner safety, contributor safety, and challenger safety, emphasizing how psychological safety enables innovation, especially with AI adoption. Skibbe discusses the balance between psychological safety and accountability, presents measurement questions from Edmondson's research, and shares Amazon's "Correction of Errors" process that focuses on learning rather than blame. She provides actionable strategies including modeling vulnerability as a leader, encouraging open communication about threats, creating structured input channels, and celebrating when issues are raised. Resources recommended include Edmondson's "The Fearless Organization" and Tim Clark's work on psychological safety.
; This article is entirely auto-generated while preserving the original presentation content as much as possible. Please note that there may be typos or inaccuracies.
Main Part
Understanding Psychological Safety: Definition and Critical Importance for Security Teams
Hello everyone. I'm Jessie Skibbe, a Principal Security Strategist at AWS. If you're here, I hope you've learned something about building psychological safety within your security team. How many people out there are on a security team or lead a security team? This is a really relevant topic, and I hope we dive into it because right now there's so much changing with AI and generative AI. Our security teams have to keep up, and not only do we have to be innovative, we have to understand how the cloud works. We have to be security experts, and we have to learn everything about generative AI. It's a great time to be an innovator, but it's also a time that can be really high pressure for builders on your team.
Today we're going to talk about what psychological safety is, why it's important to you, and why you should focus on this in your team. I'm going to give you some practical implementation strategies. I've led fairly large security teams at AWS and prior to AWS, and I'm going to share some of my personal experience, mistakes that I've made, and how I've learned from them. We're going to talk about what it is and also what it's not, and how to measure it on your team with some questions and ways to know if you have it or if you don't have it. I'll provide some actionable next steps to help you take this away and actually build more psychological safety within your teams.
Psychological safety is defined in a book by author Amy Edmondson, who first coined the phrase in her 2018 book "The Fearless Organization." The definition is a shared belief within a team or organization where members feel safe to take interpersonal risks without fear of negative consequences. In my own words, I would describe it as feeling safe in your team environment to show up as yourself, to express your opinions, and to disagree. You feel safe to learn.
Psychological safety is foundational for driving a culture of security and innovation. This is part of our culture of security track here at re:Invent, and hopefully you'll see a lot of different themed topics where we talk about ways that we build a culture of security within AWS and ways that can help you ensure you have the right culture of security within your own organization. In security specifically, we have to be able to see something and say something. You have to be able to speak up in a high-stakes environment, thinking about how you respond quickly to an incident. Even if you notice an incident, you need to say something. You need to share risks and concerns.
Amy actually uses a great example in her book from the medical field where a nurse sees a doctor getting ready to give a patient the wrong medication. In an environment where you don't feel psychologically safe, that nurse is not going to say anything because she may face repercussions. Think about that same scenario in our technology teams. If we're getting ready to deploy something and a developer knows there's a flaw in the code or we know there's a known vulnerability, and the security team member is too afraid to speak up, that is not the kind of environment you want your builders to live in.
Right now is a time where security teams should be thinking about ways to use generative AI and AI technologies to create efficiencies within your own team. But if you don't have a psychologically safe environment, people are going to be afraid to speak up and share their innovative ideas. I truly believe that the best innovative ideas come from exactly where the work is performed. But if we don't feel comfortable saying, "I have a really great use case for AI in the particular task that I'm doing," we as leaders will miss out on opportunities to create more innovation. Team members need to feel first and foremost included, safe to learn, safe to contribute, and safe to challenge the status quo.
I love this fourth point because I've led very large teams and I love nothing more than when someone actually challenges me. We have a leadership principle at Amazon called "disagree and commit." Someone coming to you and being able to challenge you as a leader, saying this is why I feel this is incorrect, is incredibly valuable.
If that's not happening, if everyone's agreeing with you and your team, you know that you may not have a psychologically safe environment because people should feel comfortable to challenge when they believe that there's a better way and they have data to back that up.
The Four Stages of Psychological Safety: From Inclusion to Challenger Safety
In a psychologically safe workplace, team members trust each other. They have different perspectives that they feel welcomed and valued for. Mistakes are viewed as learning opportunities. This is so key, especially when we want to work in an innovative environment. We want to foster this safe-to-experiment environment where people can bring ideas, experiment with them safely. I'm talking specifically about AI or other types of automation that you want to incorporate, being able to feel comfortable knowing that if it's a two-way door decision, if you make a mistake, you can come back from it and then learn from that.
People must feel or know that they're not going to be punished or humiliated for speaking up. This is really important, and hopefully that's not the case in your environment. I actually delivered this same topic or a similar topic at our Reinforce event this year, and I had people come up to me afterwards and say, "Jessie, what can I do? I am a team member on the team and I don't feel like I'm in a psychologically safe environment. What can I do as a member of the team?" So I'm actually going to give you some tips at the end on things you can do to help build that.
First and foremost is awareness of what psychological safety is, how to measure it, whether you have it or not, and then what you can actually do about it. I really like this pyramid here of the four phases because I think this builds upon the foundation of inclusion. When we talk about inclusion, what does that mean? You feel part of the team. You feel comfortable showing up as yourself. It builds from there. You can't get to challenger safety if people don't feel included on the team.
Feeling included and accepted is a basic human need to belong. We all have that. You want to feel like you are valued on the team, that you belong on the team, that your voice is important. Because if you don't feel that, then your true value as a team member is not being experienced. This goes for everyone, whether you are introverted and don't like to speak up, kind of like me, believe it or not, or whether you communicate in different ways. These are all things where humans just want to feel that sense of belonging.
From there, you build learner safety, which is so important, especially right now in security because of everything that's happening with AI. Think of everything we're releasing here at Reinforce. People have to feel safe to ask questions and safe to learn, feeling comfortable with your own knowledge and skill set and being able to ask questions as a learner. You have to foster that environment on your team so people feel they're not going to be made fun of or judged because they don't understand. They have to learn.
Safe to contribute obviously builds from knowing that you feel like you belong on the team, you've got the safety to learn, and then that leads into contribution. This is where I believe a lot of the innovative power of this comes into play. Because if you've got a great idea but you don't feel like you belong or you don't feel like you have learner safety, you're not going to share that idea. It really builds upon itself.
Challenger safety is the absolute highest level on the psychological safety pyramid. This has to be done right. The thing that we don't want to do is have people speaking in an incorrect way and challenging you just openly. But being able to feel that you have the sense of value on the team and that your opinion matters creates that environment we're looking for.
I really like this diagram as well. Tim Clark wrote another book on psychological safety called The Fearless Organization. I'm going to give you a link to his book at the end too. This is something that Tim Clark talks about in his book, and I really like it because I think we've maybe all been in work environments that are similar to this. So if we have psychological safety going from low to high and then we have accountability going from left to right, we see that if there's no accountability on the team and then no psychological safety, you're in this apathy zone.
You're in this apathy zone where you go with the flow, you don't say anything, you don't rock the boat. This could be someone who is totally disengaged and doesn't feel like they're part of something. If you move up to low accountability but high psychological safety, that means everyone really likes each other and gets along great, but nothing gets done because you don't have the accountability that goes along with the psychological safety.
The ideal zone is up in that far right-hand corner because that's where learning is happening. You've got high levels of psychological safety and a super collaborative environment where people really enjoy working together. They're safe to disagree with each other and challenge each other in the right way while getting to the right outcome because they have accountability. If you don't have psychological safety but you have high accountability, meaning you are pushed to deliver results or impact without psychological safety, builders can live in a very anxious zone. They're worried about their job, they don't feel like they belong, and they're not necessarily innovating because they don't feel safe to share. I think we've all maybe been in work environments where you felt pressure to deliver but you didn't feel safe to contribute.
Measuring and Building Psychological Safety: Practical Implementation Strategies and Resources
So how do you measure this? We've given some examples and talked through what to do and what not to do. Amy Edmondson talked about creating psychological safety, and I think that it's actually on her website so when I give you the link here in a little bit you can check it out. At Amazon, we do a lot of daily surveys asking how you are experiencing your work environment. One way to get a measurement is to ask these questions to the people on the team. For example, if you make a mistake on this team, is it often held against you? Using a scale of one to five is a good way of measuring this. Members of this team are able to bring up problems and tough issues. You can read all these or take a photo, whatever works for you, but this is one way that you can get feedback from team members to start to see where you might have a problem.
Obviously, these surveys should be anonymous because you want people to feel safe to answer these questions. It is one way that you can actually measure how you're doing. If you're a team lead or a leader within your organization, this is something that you can take away. If you are not in a position of leadership and you feel you might have a psychological safety issue on your team, you could very gently present some of these ideas to your manager or to leadership and say let's see where we're at. I know it's a more difficult conversation, but I think everyone has the potential of being a leader on your team and hopefully you feel safe to bring it up.
I wrote this thinking that the majority of people who would really be deeply interested in this topic would be in a leadership position in their security team, really caring about creating the right culture for their builders. One of the things that I personally have done in my role is not only frame mistakes that other people make as a learning opportunity but also share my own mistakes. Having the vulnerability to share that I made a mistake and here's how I am learning from it and how we're going to scale beyond this is absolutely the best thing that you can do because it shows people that it's a safe environment to admit that you made a mistake. Mistakes are nothing more than learning opportunities, and so that's part of you as a leader being vulnerable enough to share those types of mistakes helps other people feel comfortable doing the same.
We actually have a process at Amazon called the Correction of Errors process, and I absolutely love it because when something happens we have a way of doing the five whys and diving into the issue, but the culture around it is no blame. We're not blaming anyone, we're not looking for someone to blame. We're looking for ways that we can prevent that issue from ever happening again. In the entire process of how we interview and how we dive through the five whys, we're never looking for a single individual to blame, and so that's another great mechanism that you can use to make sure that people look at those errors as learning opportunities.
So here are actionable next steps you can take. Encourage open communication about threats and vulnerabilities, specifically on your security team, and create structured channels for inputs. To be a truly inclusive environment where people feel that they belong, as a leader you sometimes may need to look for other ways to communicate if people don't feel comfortable raising their hand in a public meeting. Give them a way to respond with email or text, different ways of communicating to bring in more of that inclusive voice. Then celebrate issues that are communicated to make sure they understand and feel part of the process.
Modeling vulnerability yourself as a leader is also important, and I think this is true whether you're the leader of the security team or a leader on the security team or any team that might be applicable to you. If it feels safe to you and you can be a model for someone else, you can talk about an issue or an error that you made as a learning opportunity and see what changes in the culture. So again, this quote from Amy Edmondson, who is basically one of the founders of this term and has done such deep research on this, she says: "Psychological safety is a belief that one will not be punished or humiliated for speaking up with ideas, questions, concerns, or mistakes, and that the team is safe to take interpersonal risks."
With that, I do want to leave you with these resources. I talked about Amy Edmondson and her book, The Four Stages of Psychological Safety. It is a well-researched book, and she is well known for her deep research in this space. Then there's The Fearless Organization by Tim Clark, which I really liked as well because it has a lot of good tips about how psychological safety leads to innovation. Since we're all in a technical field where innovation is really important, looking at psychological safety as a foundation for innovation is valuable. The last resource I found really helpful when doing my research for this session is the Psychology Today article, because I think sometimes we don't have the best resources and tools that are immediately actionable. I loved that Psychology Today article, so I put that on here for you. Well, thank you all so much for joining, and I hope you took something away that you can implement within your own team. Thank you so much.
; This article is entirely auto-generated using Amazon Bedrock.
Top comments (0)