How Behavioral Science Improves Cybersecurity Compliance: Why Employees Bypass Security Controls

Last updated October 25, 2026

Verizon's 2026 Data Breach Investigations Report, drawn from more than 22,000 confirmed breaches, found that 45% of employees now regularly use AI on their work devices, approved or not, up from 15% a year earlier. About 2 in 3 of those AI users sign in with personal accounts rather than company ones.

Behavioral science improves cybersecurity compliance by finding the moments where following a security rule costs employees more than working around it, then redesigning those moments so the secure option is also the easiest one. At The Decision Lab, we study why employees work around the tools and rules their organizations provide, from AI tools at a 20,000-person Fortune 500 company to fraudulent emails in our own controlled experiments, and security workarounds follow the same pattern.

The gap goes well beyond AI. In a Gartner survey of 1,310 employees run in mid-2022, about 7 in 10 said they had bypassed their organization's cybersecurity guidance in the previous 12 months, and about 3 in 4 said they would do it if it helped them or their team meet a business objective.

Our clearest evidence on this kind of workaround comes from AI adoption. A Fortune 500 HR technology company we worked with had rolled out AI tools across its 20,000-person workforce, with training and internal communications behind them, and usage stayed low. The barriers we found were behavioral, among them unclear usage guidelines and low trust in AI accuracy, and the same barriers sorted employees into enthusiasts who hit friction and skeptics who stalled at first contact. Those barriers can also open the door to shadow AI. When approved guidance is unclear or the approved tool is harder to reach, some employees probably turn to personal accounts to finish urgent work. We have not measured that link directly, so security teams should test it against their own employee research and usage data.

1. Security costs fall on the employee, while the benefits go to the organization.
2. The secure path is slower than the workaround.
3. The risk feels distant and the pressure to act feels immediate.
4. Mistakes are punished, so people hide them instead of reporting them.

Adam Beautement, Angela Sasse and Mike Wonham described this as the compliance budget. Employees weigh what each security step costs them personally against what it seems to protect, and their willingness to comply is limited, so every new demand competes with the ones already in place. A policy can be correct on its own and still fail once it is added to a dozen others.

In practice, a security team asking for one more check usually cannot see how many checks employees already carry. We look for that total first, because the cheapest fix is often removing a step that protects little rather than adding a reminder about the one that matters.

In the same release, Gartner's analysts named friction that slows employees down as a significant driver of insider risk, and the 3 in 4 employees willing to bypass guidance for a business objective were describing exactly that trade. Shadow AI is the current example. When the approved AI tool needs a request form and a personal account takes a minute to open, a deadline settles the choice, and nothing in the moment tells the employee what the personal account costs the company.

What an email is about changes how many people click it. In a randomized phishing study at UC San Diego Health, covered in more detail below, a fake Outlook password update was clicked by fewer than 1 in 50 recipients, while a fake update to the vacation policy was clicked by about 3 in 10. The vacation message probably worked because it touched something employees cared about and wanted to act on quickly.

We have tested a version of this in our own work. In a controlled experiment on susceptibility to financial scams with 102 North American adults, participants read an investment pitch built with common fraud warning signs. Adults aged 60 and over who first completed a short personal financial risk assessment rated the pitch as less appealing and were less willing to invest than a control group who skipped it, and the difference was statistically significant. The same step had no effect on adults aged 18 to 25. A prompt that makes people step back from the details of a message can lower susceptibility, and it may help one group of employees and leave another untouched.

An employee who clicks a phishing link and expects to be disciplined has a reason to stay quiet, and a quiet click gives an attacker time. Gartner recommends that insider risk programs respond to risky behavior with corrective guidance rather than punishment. Reporting is also where employees add the most value to a security team, as the ETH Zurich phishing study covered below shows.

Two large, long-running field studies of phishing training found small or negative effects.

A team led by Grant Ho at UC San Diego ran a randomized experiment on phishing training with more than 19,500 employees of UC San Diego Health, across eight months and 10 simulated phishing campaigns. Employees who had recently completed annual security training were no less likely to click than those who had not. Training shown straight after a failed test lowered the chance of clicking by only about 2%, according to the university's summary of the study, and 3 in 4 employees spent a minute or less on that training page. By the eighth month, more than half of employees had clicked at least one simulated phishing link.

Daniele Lain, Kari Kostiainen and Srdjan Čapkun at ETH Zurich followed 14,733 employees of one company for 15 months. Employees who were shown voluntary training material after failing a simulated test went on to click more simulated phishing links than those who were not shown it, with about 3,600 clicks in the trained group against about 3,100 in the untrained one.

Both studies point to the same limit: a short lesson delivered away from the moment of decision has to compete with a full inbox and a deadline. Training still has a job in explaining what a policy is for and what to do after a mistake, but a program built mainly on annual modules and click-rate scores is measuring the wrong behavior.

AI makes the attacker's job cheaper. In a study published in Expert Systems with Applications in 2026, Fred Heiding, Bruce Schneier and colleagues tested AI-written spear phishing on 101 participants. Personalized emails written entirely by AI were clicked by 54% of recipients, the same rate as emails written by human experts, against 12% for a generic phishing email sent to a control group.

When every phishing email can be personalized at little cost, asking employees to spot the suspicious one gets harder each year. Controls that do not rely on spotting it, such as sign-in methods that cannot be phished and warnings built into the email client, become more valuable, and the employee's most useful job shifts from detecting phishing to reporting it quickly.

AI also changes the risk from inside. In Verizon's announcement of the 2026 report, shadow AI ranked as the third most common way employees leak data without meaning harm. The tripling of regular AI use on work devices described at the top of this guide happened in a single year, faster than most organizations update an acceptable-use policy.

These four interventions have the strongest support in the field studies above.

1. Take the decision away from the employee where you can. The UC San Diego researchers recommend two-factor authentication and password managers that only fill in credentials on the correct website, so a convincing fake page has nothing to collect.
2. Warn people at the moment of risk. In the ETH Zurich study, a short warning on a suspicious email cut clicks on simulated phishing links to about a third of the level seen with no warning, and a detailed warning did not perform significantly better than a short one.
3. Make reporting one click, and answer every report. Participants in the same study reported more than 14,400 suspicious emails, about 2 in 3 reports were correct, and reports of real phishing in the final five months helped the security team identify 252 large-scale campaigns.
4. Make the approved path the fastest one. For AI, that means approved tools with company sign-in that are as quick to open as a personal account, plus usage guidelines specific enough that employees know what they can paste in.

We plan a first cycle over 30 to 60 days, in six steps.

1. Audit the highest-friction security workflows, starting where help-desk tickets, policy exceptions and failed phishing simulations cluster.
2. Interview employees in the roles most likely to face workarounds, such as staff who work under tight deadlines or outside the office.
3. Choose one behavior to change, such as reporting suspicious emails or using personal AI accounts for work.
4. Pilot one workflow or messaging change. Changes that depend on attention, such as the wording of a warning or the placement of a reporting button, are worth testing against a control group, because as our scam experiment showed, the same intervention can work for one group and do nothing for another. Changes that remove the decision, such as moving to phishing-resistant sign-in, rarely need a trial, and a before-and-after comparison is usually enough.
5. Measure behavior instead of course completion: reporting speed, use of approved tools, unsafe workarounds and incident outcomes.
6. Scale only the changes that improve behavior without adding work for employees or the security team.

Our role in that sequence is the diagnostic and design work: finding which barrier holds back which group of employees, and building interventions aimed at each one. A rushed salesperson and a skeptical engineer usually need different fixes, and the security team's own simulation and incident data shows us where to start.

At the Fortune 500 company, this process produced 20 candidate programs, each aimed at a specific barrier for a specific group of employees. We piloted eight of them for one month with more than 100 employees against a control group. Confidence in exploring AI tools, measured before and after the pilot, rose 41% in the pilot group and fell 26% in the control group, and the programs are now scaling to the full workforce, with the protocols and guides the client's teams need to run them. We have also worked with the Ontario Securities Commission on protecting retail investors from fraud, designing evidence-based recommendations for its investor education resources.

We are not the right partner for a missing control or an unpatched system. That is a job for security engineers. We work on the human side, once the controls exist and employees are routing around them.

How can behavioral science improve cybersecurity compliance?

Behavioral science improves cybersecurity compliance by finding the specific moments where following a rule costs employees more than breaking it, then redesigning those moments. Typical changes include removing low-value steps, putting warnings where decisions happen, making approved tools faster than workarounds, and testing each change against a control group before rolling it out.

Why do employees bypass security controls?

Most employees who bypass security controls are trying to get their work done. A Gartner survey of 1,310 employees found about 3 in 4 would bypass guidance to meet a business objective. Common causes are slow approved processes, rules that feel disconnected from real risk, unclear policies and fear of being blamed for mistakes.

Does security awareness training work?

Training on its own shows weak effects in the largest field studies. At UC San Diego Health, recent annual training made no measurable difference to phishing clicks across more than 19,500 employees. At ETH Zurich, voluntary training after a failed test was linked to more clicks. Training works better alongside warnings, easy reporting and stronger sign-in controls.

What are behavioral interventions for phishing prevention?

Behavioral interventions for phishing prevention change the conditions around an employee's decision instead of relying on memory from training. The best-supported ones are short warnings on suspicious emails, a one-click reporting button with quick feedback, password managers that only fill on real websites, and sign-in methods that a fake page cannot capture.

What is shadow AI?

Shadow AI is employees' use of AI tools their employer has not approved or cannot monitor, often through personal accounts on work devices. Verizon's 2026 breach report found that about 2 in 3 employees using AI on work devices sign in with personal accounts. It usually signals that the approved route is slower or less clear.

What is the compliance budget in cybersecurity?

The compliance budget is a model from security researchers Adam Beautement, Angela Sasse and Mike Wonham. It holds that employees have a limited willingness to absorb the personal cost of security steps. Each new requirement draws on the same budget, so adding policies can lower overall compliance once employees start choosing which ones to skip.

Should employees be disciplined for failing phishing tests?

Punishing failed phishing tests tends to discourage fast reporting, the behavior security teams need most. Gartner recommends corrective guidance rather than punishment for risky behavior. Large field studies also show that some clicks are inevitable at scale, so a program gains more from rewarding quick reports than from penalizing individual mistakes.