The Story Behind Sarah and the Malware Fairy

I wrote Sarah and the Malware Fairy because cybersecurity education usually starts too late and sounds too boring. Kids live online. Families live online. Schools live online. And yet we still explain online safety to children with the same dry warnings we give adults in a corporate training video, then act surprised when none of it sticks.

The gap I kept noticing

We teach children to look both ways before crossing the street. We teach them not to talk to strangers. We drill physical safety into them from the time they can walk. Then we hand them a device that connects them to the entire world and offer, at best, a lecture about passwords. The street most kids actually spend their day on is digital, and we have been strangely silent about it.

The instinct, when adults do address it, is fear. Scare the child away from the danger. I understand the impulse and I think it usually backfires. Fear does not teach. It freezes, or worse, it makes the topic feel forbidden and therefore interesting. I wanted to do the opposite.

Why a story, and why a fairy

Children do not learn abstract rules. They learn through characters and stories they can carry in their heads. So I built the lesson into a narrative. Sarah is the child the reader follows. The malware shows up not as a terrifying hacker in a hoodie but as something a kid can picture, name, and outsmart. The point was to make the danger understandable rather than frightening, and to make the child the one with the power to handle it.

You do not protect children by scaring them. You protect them by making the danger small enough to understand and beatable enough to face.

What I wanted kids to walk away with

Not a list of rules. A set of instincts. That some things are private and stay private. That a stranger online is still a stranger. That if something feels wrong, you tell a grown-up, and you are never in trouble for asking. Those instincts matter far more at age seven than knowing what a strong password looks like, and they last.

Why this connects to the rest of my work

People are sometimes surprised that an executive who spends his days on enterprise risk wrote a children's book. To me it is the same work at a different scale. Most security failures, in companies and in homes, are human before they are technical. If you want adults who make good security decisions, you do not start with adults. You start with seven-year-olds and a good story. That is the whole idea behind Sarah and the Malware Fairy, and it is why I am prouder of it than of most things with my name on them.