They're Not Breaking the Rules. The Rules Are Broken

Nearly a thousand people were using a tool that legal wanted to block. Instead of blocking it, we asked why they were all using it in the first place. That question changed everything.

In this episode, I take a concept from urban planning called desire paths and apply it to security awareness. A desire path is the shortcut worn into the grass where people ignore the official route and walk where it actually makes sense. Your organisation is full of them. Every workaround, every unsanctioned tool, every file emailed instead of uploaded to the portal.

Most organisations respond by blocking the shortcut. The research says that makes things worse. So what should practitioners do instead? Watch where people are actually walking.