UpTrajectory Review

Aaron Kay reports on six experiments with more than 2,800 participants, all pointing to an uncomfortable finding for anyone who has ever written an IT policy: strict cybersecurity rules can actually make employees less convinced that digital threats are real. The mechanism, as HBR frames it, is not simple carelessness. When organizations impose rigid, top-down controls, employees read them as a signal that the risk is being managed on their behalf — or worse, that the risk is being exaggerated to justify control. The compliance theater that follows looks like safety and functions like complacency.

For a small-business operator, this lands hard because the default advice has always been 'get serious about security': enforce password managers, mandate training, lock down devices, write the policy, make people sign it. Kay's research suggests the enforcement-heavy version of that playbook may be self-defeating in a small-team setting, where trust is personal and bureaucracy is visibly out of proportion to the threat. A five-person company that treats employees like a bank's compliance department is not just wasting effort — it may be training its own staff to stop taking threats seriously.

What is genuinely new here is the scale and design of the evidence. This is not one survey of self-reported behavior; it is six experiments with a large combined sample, which gives the finding more weight than the usual 'employees hate security training' anecdote. We are somewhat skeptical of one thing the framing may gloss over: the experiments likely measure belief in threats, not actual security outcomes. An employee who doubts phishing is dangerous and an employee who clicks a phishing link are related but distinct problems. The original piece presumably addresses this; the excerpt does not.

The second-order effects cut in a few directions. If heavy-handed rules breed skepticism, then the businesses most at risk of a breach may be the ones that responded to a scare with the strictest policy — a perverse outcome. It also shifts where the burden falls: instead of IT or the owner as rule-enforcer, the work becomes building genuine threat awareness, which is slower and demands more judgment. There is a cost asymmetry too. A lax small business that gets hit once can be wiped out; a large enterprise absorbs the same breach as a line item. Small operators cannot afford to learn this lesson empirically.

What to do next: audit your security communications for tone before you audit your controls. If your policy reads like it was written by a lawyer to protect the company from its own staff, rewrite it in plain language that explains the actual threat — a real phishing attempt that hit a similar business, a concrete loss — rather than citing rules. Watch for whether Kay's work gets replicated in field settings with real breach data, because that is the gap between 'employees are skeptical' and 'employees cause breaches.' In the meantime, treat security as a shared problem to be understood, not a rule to be obeyed.

“Six experiments involving more than 2,800 people show how rules meant to reduce risk can end up weakening employees' belief in digital threats.” — Harvard Business Review

Takeaway: Strict security rules can breed complacency, so explain real threats in plain language instead of enforcing policies that signal risk is someone else's problem.