Jan Kolouch: Don’t Ban Technology. Start Learning

Part One of an Interview with Jan Kolouch, Cyber Teacher of the Year 2025

With a background in law, Jan Kolouch has built a career at the intersection of law and cybersecurity. Today, his work covers not only cybercrime but also digital safety awareness and education for children, parents and professionals. He has a talent for making complex topics accessible, using humour to naturally draw his audience into the subject.

Read the first part of our interview with Jan Kolouch, CESNET’s cybersecurity expert, to find out what being named Cyber Teacher of the Year 2025 means to him, how he approaches digital safety education and why he believes in education rather than bans. What makes a lecture truly work? And why are parents sometimes the hardest audience to reach?

Last autumn, you were named Cyber Teacher of the Year. What does the award mean to you?
It’s a tremendous honour – and at the same time, it gives me a deep sense of happiness to know that the things I devote my time to actually matter. Not just to me, but to other people as well. That people thought what I do might be worth recognising and sharing with others. And I think that’s what I value most about the award.

When you’re preparing a lecture, where do you start?
First, I find out who it’s for. There’s a huge difference between speaking to professors, parents or primary school children. I try to understand what they need to know first, and only then do I add other “pieces” that I know are connected to the topic.
The setting matters too – whether it’s a professional conference, some kind of con, or more of a freeride event where I can afford to be more playful and entertaining. That determines how I put the lecture together.

How do you know when a lecture has really worked?
Mainly from the interaction with the audience. I try to draw people in – sometimes there’s a bit of acting involved. Every now and then I deliberately exaggerate something just to get a reaction.

The absolute worst thing is silence. Even if people applaud afterwards and seem happy, if there’s no reaction along the way, I feel as though it didn’t really work.

On the other hand, when people leave feeling that they’ve actually gained something from it, that’s great. Sometimes I know it’s worked because what was supposed to be a one-hour lecture ends up lasting another two hours, simply because people keep asking questions and want to know more. That’s when I know the time was well spent.

Do you feel that audiences have changed in recent years?
Definitely. More and more often, I meet parents who grew up with social media themselves. They see the online world as something completely natural, but they started with Facebook – and quite often, Facebook is where they stayed.

When I ask them about other social networks or online games, I realise they’ve essentially become “stuck”. They feel they understand the digital world because they grew up in it, but then they look at the younger generation and say, “Actually, I have no idea what they’re doing.”

It’s a strange paradox. They see themselves as digital natives, but they stayed on the beach and never ventured into the jungle. And they are often less aware of the risks. Paradoxically, grandparents who didn’t grow up in this world tend to be much more frightened of it than the middle generation, who simply say, “It’s fine. It’s just the internet.”

So do you feel that something “clicks” for them after your lecture?
Yes. Sometimes a little too much. They leave thinking they’re going to switch off the Wi-Fi at home, ban social media, YouTube and YouTubers. And that’s exactly what I tell them right at the beginning: don’t do that. Start learning.

It’s the same as when we had to learn how to navigate the internet. The solution isn’t to ban technology, but to understand it and set appropriate boundaries and limits. Bans simply don’t work in the long run.

What do you think is the hardest part of teaching cybersecurity?
Convincing people roughly between the ages of 30 and 55 to show up in the first place. When I speak to students, it’s actually quite easy. They already live in that environment, they understand it, and I’m simply adding another piece to the puzzle. Whether they accept it or not is up to them, but they understand the basic framework. With their parents, it’s different. I can give a lecture to 600 children and ten parents will turn up. And their answer is often, “I don’t have time for this.”

But we’re not going to be able to function without these technologies anymore. We’re moving towards digital ID cards and fully digital identities. And yet there’s still a huge group of people who fall for the “American soldier” or the “Russian princess” scam and have no idea how serious the consequences can be.

The hardest thing is convincing working-age adults that cybersecurity is simply part of everyday life. Just as we lock our homes or turn off the water before going on holiday, we also need to think about our safety online. And we need to realise that nobody else is going to do it for us. I think that’s a major failing – for our organisation as well. We often say, “We’ll provide it for you,” but forget to add the most important part: “It simply won’t work without you.”

Next time, we’ll talk to Jan Kolouch about why we tend to be more complacent online than in the physical world, how information overload affects us, and how AI is changing the rules of the game for both defenders and attackers.