The Psychology of Security: A Conversation with Gary S. Chan, CISO of SSM Health

Most conversations about cybersecurity revolve around systems: networks, endpoints, vulnerabilities, the latest tool. My conversation with Gary S. Chan revolved around something harder to patch: the human mind. Chan is Chief Information Security Officer of SSM Health, a nonprofit healthcare organization with 50,000 team members. He is also a trained interrogator and performing mentalist. To him, these are the same discipline seen from different angles.

Chan studied electrical engineering and computer science at MIT, worked in IT consulting, and moved into identity fraud prevention, where the adversary is often someone pretending to be someone else. Along the way, he trained as an interrogator. Today he leads security for a major health system, though he made clear he spoke with me personally, not on behalf of his employer. Each step reinforced his belief that security is ultimately about people.

The name tying it all together came almost by accident. At his wife’s work dinner party, Chan introduced himself to some guests as a security specialist and to others as a mentalist. Neither description drew much interest. Later, two guests compared notes and asked which one he really was. Rather than choose, Chan combined the two on the spot: “Security Mentalist.”

The mood changed instantly. Everyone wanted to know what a Security Mentalist did. Chan spent the next half hour telling hacker stories, and the lesson stayed with him: the same facts, framed differently, can move an audience from indifference to fascination. He now has a trademark pending on Security Mentalism®.

That instinct for framing sits at the core of his philosophy. Chan argues that the human element is the most critical and overlooked layer in security. From interrogation, he draws on managing “headspace”: people have limited cognitive capacity, and how that capacity is loaded shapes what they reveal. Mentalism helps him understand how attention and suggestion guide decisions. Game theory provides a framework for anticipating others’ actions. Together, these ideas help him defend an organization and navigate it.

As a Security Mentalist and keynote speaker, Chan shows audiences how social engineering and hidden influence can exploit even smart people and secure systems.

The toolkit has real-world stakes. Chan described a job applicant with an impressive resume who passed a technical interview and convinced the hiring manager. Chan examined the resume and LinkedIn profile again. He wasn't scanning for keywords. He was looking for psychological and narrative inconsistencies, places where the story didn't hold together. He discovered the candidate was fake before the company made a bad hire. As polished credentials and confident interviews become easier to manufacture, reading the story behind a resume is a security skill in its own right.

Partway through our conversation, Chan demonstrated his point with a deck of cards. He spread the cards across the table, placing a duplicate of one card face down to the side before asking me to choose any card. He even let me change my mind. I chose the Three of Spades. It matched the card that had been sitting face down in full view the entire time. The moment captured what he'd been describing: attention, framing, and influence can shape a decision someone believes is entirely their own.

Listening to Chan makes one thing clear. The attack surface that matters most isn't purely technical. Fraudsters exploit narratives, employees resist change, and executives respond to stories more readily than specifications. Security leaders who understand psychology as deeply as technology can better protect their organizations and move them forward. Chan has built his career and stage persona around that idea.

Learn more about Gary S. Chan and security mentalism at https://www.securitymentalist.com. Follow him on YouTube at https://www.youtube.com/@SecurityMentalist.