This is all about habits. And it is a twin spin from an MIT lab and a self-help professor at Utah State University, a seemingly deadly combination, but which may hold the key to how to sell security to the boss and employees, how to balance values and principals professionally and personally as well as how to sell Febreze at Walmart, if you want.

The MIT neuroscientist, Ann Graybiel, says she and her colleagues began exploring habits more than a decade ago by putting rats into a maze with chocolate at one end. Graybiel continues to study the basal ganglia, forebrain structures that are profoundly important for normal brain function and also linked to Parkinson’s disease, Huntington’s disease, obsessive-compulsive disorder and addiction. Her work is uncovering neural deficits related to these disorders as well as the role the basal ganglia play in guiding normal behavior.

Cue, Routine, Reward

The bottom line: the process within our brains that creates habits is a three-step loop. First, there is a cue, a trigger that tells the brain to go into automatic mode and which habit to use. Then there is the routine, which can be physical or mental or emotional. Finally, there is a reward, which helps the brain figure out if a particular loop is worth remembering for the future. Over time, loops – cue, routine, reward; cue, routine, reward – become more automatic.

No doubt, habits aren’t destiny.

But, when selling security plans to the boss or to employees, cue, reward, routine can make a difference.

What’s happening in businesses and sports can be replicated for enterprise security leaders.

For example, many major retailers, from grocery chains to investment banks to the U.S. Postal Service, have what they may call a “predictive analytics” department devoted to understanding not just consumers’ shopping habits but also their personal habits, so as to more efficiently market to them.

Tony Dungy, the football coach, reinvented one of the least performing teams in the NFL to the Super Bowl by focusing on how his players habitually reacted to on-field cues. Before he was named U.S. Treasury secretary, Paul O’Neill overhauled a troubled conglomerate, Alcoa, and turned it into a top performer by fine focusing on one habit – worker safety – which in turn led to companywide transformation.

Then there was Febreze, the odor eliminator from Procter and Gamble. It was originally a failure when first introduced. The product’s cue – the bad smells that were supposed to trigger daily use – was hidden from the people who needed it the most. And Febreze’s reward, an odorless home, was meaningless to someone who couldn’t smell offensive scents in the first place. After much analysis, P&G discovered that it was using the wrong cues and routines to lead to the reward. They adjusted from smelly homes and Febreze has turned out to be the best selling P&G brand.

Making Things Automatic

Habits are sequences of behavior that are learned to the point where they become automatic. Many everyday motor actions become habitual through repetition, but we also develop habits of thought and emotion.

Which gets us back to security.

Enterprise security leaders who focus on those cues, routines and rewards when it comes to getting employees to be a real part of the security effort can pay off. The same strategy can also work with the boss, too.

Habits can also be elements of values and principals.

Dr. Stephen Richards Covey from Utah State University has a new book, “The 8th Habit: From Effectiveness to Greatness,” Covey argues against what he calls “The Personality Ethic,” something he sees as prevalent in many modern self-help programs. He instead promotes what he labels “The Character Ethic,” aligning one’s values with so-called “universal and timeless” principles. Covey adamantly refuses to conflate principles and values; he sees principles as external natural laws, while values remain internal and subjective. Covey proclaims that values govern people’s behavior, but principles ultimately determine the consequences. Covey presents his teachings in a series of habits, manifesting as a progression from dependence via independence to interdependence.

Which also gets us back to security. Programs for employees work best when emphasizing on principals. People already have instilled their own values for better or worse. It is also valuable for security executives to understand, appreciate and follow the principals of the enterprise – the corporate culture, so to speak, as set by the chief executive officer and the history of the organization.