Cybersecurity leaders have spent years telling employees to follow the rules, complete their awareness training and stop taking shortcuts. Yet the same mistakes keep happening. Maybe the problem isn't that employees don't understand security. Maybe the organizations employing them have made doing the right thing unnecessarily difficult.
That's the argument at the center of the latest episode of CYBR.Minded, where host Dr. Dustin Sachs sat down with Craig Wood, founder of PSY Logistics Technology Partners, Inc., to explore how business pressure, workplace culture and competing priorities influence cybersecurity decisions.
Their discussion challenged a persistent assumption in security: When someone bypasses a control, the answer is usually more training.
Sometimes, Sachs argued, the answer is to fix the environment that made bypassing the control seem reasonable in the first place.
Full episode:
, and CYBR.SEC.Media
When business priorities undermine cybersecurity
Wood, a veteran of more than two decades in infrastructure and security leadership, believes CISOs must understand something their technical backgrounds don't always prepare them for: Businesses exist to take risks, not eliminate them.
Security professionals often approach decisions by identifying what could go wrong. Executives, meanwhile, are evaluating what could go right.
That disconnect can turn security teams into obstacles rather than partners.
Wood compared cybersecurity to the brakes on a race car. Brakes aren't there simply to stop the vehicle. They allow the driver to navigate difficult turns safely while maintaining speed.
The same principle applies to security controls.
Security leaders must understand business objectives, communicate potential consequences and help executives make informed decisions rather than reflexively rejecting anything involving risk.
"You cannot make an informed decision if you're not informed," Wood said.
Stop blaming employees for broken workflows
Sachs pushed the conversation beyond executive decision-making to the everyday pressures facing employees.
Consider software developers whose performance depends on shipping functional products on schedule. If speed and delivery determine their bonuses, while secure development receives little recognition, the organization has created an incentive to bypass security.
The employee may understand the policy perfectly. Following it simply conflicts with what management rewards.
Sachs argued that leaders need to examine the entire workflow before assuming additional training will solve the problem.
Where must employees interpret ambiguous rules? How many approvals are required? How long must they wait for answers? And what happens when following the approved process threatens a deadline?
Repeated workarounds can reveal weaknesses in the system itself.
That doesn't excuse unauthorized shortcuts. It means leaders must make it easier for employees to raise concerns, explain why a requirement cannot be met and request an approved alternative.
The goal is a culture where questioning an impractical instruction is encouraged rather than punished.
The hidden risks of moving too fast
Wood pointed to mergers and acquisitions as another example of business pressure overwhelming security judgment.
Companies racing to close deals can underestimate the technological, regulatory and cultural liabilities they're acquiring. The consequences emerge later as unexpected compliance obligations, security exposures and expensive remediation projects.
The problem isn't necessarily the decision to accept risk. It's accepting risk without understanding its potential consequences.
Wood also warned that organizations sometimes become complacent because they've successfully absorbed previous losses.
Financial resilience, however, doesn't eliminate the need to understand exposure.
AI adoption is putting the problem on steroids
The conversation eventually turned to artificial intelligence, where the same organizational weaknesses are becoming increasingly consequential.
Wood identified AI adoption as an area where cybersecurity needs more deliberate decision-making. Boards want AI deployed quickly, businesses fear falling behind competitors, and employees are eager to automate their workloads.
Security governance struggles to keep pace.
Wood's answer isn't to stop adopting AI. It's to bring business leaders, technical specialists and security professionals together before deploying new capabilities broadly.
Controlled pilots, cross-functional reviews and clear authority to halt dangerous implementations can help organizations identify exposures before they become enterprise-wide problems.
The larger lesson extends well beyond AI.
Cybersecurity improves when leaders stop treating human behavior as an isolated weakness and start examining the conditions shaping it.
As Sachs emphasized in closing, organizations should ask where safe choices become difficult during an ordinary workday, then change the workflows, support systems or decision-making processes responsible.
The human side of cybersecurity isn't just about changing people. It's about changing the systems that influence what people do.
