Why “Just Trying to Get the Job Done” Is a Leading Cause of Data Breaches And How to Prevent It

In the second of a series exploring the psychology behind insider data breaches, Egress CEO Tony Pepper looks at the employees who are intentionally taking risks with company data. If you missed the first instalment, read it here.

Insider threats are not always caused by employees deliberately trying to harm an organisation. In fact, most employees have probably found a workaround at some point when corporate security policies or tools appeared to get in the way of their work.

Actions such as putting off software fixes or system updates to avoid closing applications, ignoring email security policies or downloading sensitive data to personal devices to finish work at home might seem harmless. Often, they are driven by good intentions. However, these deliberately risky behaviours can have serious consequences for an organisation's data security.

A data breach is a data breach, regardless of whether it results from a malicious external attack or an employee taking unnecessary risks. Organisations must therefore understand how employee behaviour contributes to data exposure and take steps to prevent it.

Email, in particular, presents significant risks when employees prioritise speed over security. People working under pressure rely on email to complete tasks and communicate quickly. Sending a group email might seem like the easiest way to get things moving, but when employees are more concerned with meeting targets than protecting sensitive information, it can quickly lead to a breach.

So, what can CISOs do to address this risk? The first step is identifying and understanding the behaviours that lead employees to take unnecessary risks with company data.

Understanding the Behaviours Behind Insider Threats

Employees who take deliberate risks with company data can sometimes see themselves as working against the organisation's security policies and tools. They view these measures as obstacles to getting their jobs done rather than safeguards that protect the business.

Others believe they understand the organisation's security systems well enough to avoid potential risks. Their confidence can make them less cautious, particularly when they are focused on completing tasks quickly.

In both cases, employees prioritise productivity over security, creating opportunities for data breaches.

In this group, we've identified two main employee personas: 'Confident Chloe' and 'Risky Raj'.

Confident Chloe: Overestimating Security Knowledge

Confident Chloe represents employees who consider themselves security-aware because they have completed the organisation's required training. They believe they can recognise security risks and avoid potential threats, giving them the confidence to focus on getting their work done.

However, overconfidence can become their biggest weakness.

These employees may understand the basics of security training but mistakenly believe this makes them experts in data protection. This reflects the Dunning-Kruger effect, a cognitive bias in which people overestimate their knowledge or abilities, sometimes leading them to make avoidable mistakes.

Confident Chloe assumes she can recognise potential risks and is therefore more willing to cut corners when security measures appear to slow her down.

This behaviour creates another problem. Because she takes pride in her work and believes she understands security, she may be reluctant to report a suspected data breach. Fear of criticism, professional consequences or simply admitting a mistake can prevent her from raising the alarm. Alternatively, she may not recognise the seriousness of the incident.

An accusation of deliberately reckless behaviour would probably be particularly difficult for this employee to accept.

Risky Raj: Prioritising Productivity Over Security

The second employee persona is Risky Raj. Typically, these are busy, long-serving employees who are constantly working through lengthy to-do lists. They are often impatient with anything that gets in the way of completing their tasks.

Getting the job done is their overriding priority, and they are willing to cut corners if they believe it will help them work more efficiently.

This might involve using alternative file-sharing or collaboration tools instead of the platforms provided by their organisation. Although they have seen security tools introduced over the years, they may not have fully adopted them because they view them as a hindrance rather than a necessary part of their work.

They might also avoid security training because they don't consider it a priority or feel they don't have time to attend.

Their fast-paced working habits can also increase the likelihood of mistakes. For example, they might send an email to the wrong recipient because they fail to notice an address autocomplete error. If they also neglect to use the organisation's email encryption tools, sensitive information could be sent in an unprotected format.

How Workplace Culture Increases Insider Risk

Both employee personas are more likely to emerge in workplaces where getting the job done takes priority over everything else.

When managers demonstrate the same attitude towards security risks or put employees under pressure to deliver results, workers may be reluctant to raise concerns about security processes. Instead, they continue working quickly, bypassing controls and taking unnecessary risks to meet expectations.

When organisations consistently prioritise productivity over security, the likelihood of data breaches increases.

Overconfident and impatient employees may also view the data they work with as belonging to them rather than the organisation, while failing to recognise their responsibility for protecting it.

According to Egress's Insider Data Breach Survey 2020, 41% of employees surveyed did not believe that data created or gathered in the workplace belonged exclusively to the organisation. Only 37% recognised that everyone had a responsibility to protect company data.

Although these figures reflect the survey's findings at the time, they highlight an important issue: employees need to understand that protecting organisational data is a shared responsibility. Without this awareness, risky behaviour can become part of everyday working practices.

How Can Organisations Prevent Insider Threats?

Understanding the psychology behind employees who deliberately take risks with company data can help CISOs identify the technologies and strategies needed to reduce insider risk.

However, simply introducing more security policies or training is unlikely to solve the problem. Organisations must also consider why employees bypass existing controls and make secure working practices easier to follow.

Make Security Tools Easier to Use

One of the most important considerations is ensuring that security tools fit naturally into employees' workflows.

Anything that introduces unnecessary steps or slows people down increases the likelihood that they will ignore or work around security controls.

For example, tools that automatically encrypt emails and secure communication channels based on the content being shared and the sensitivity of the data can help prevent information from leaving an organisation in an unprotected format.

Automating these decisions also removes the responsibility from employees who might otherwise overlook encryption or choose not to use it.

Organisations should also consider the experience of external recipients. If accessing secure communications involves too many steps, recipients may push back, potentially encouraging employees to share the information through less secure channels instead.

Use Technology to Prevent Email Security Mistakes

To reduce email mis-sends and other mistakes caused by employees working under pressure, CISOs can use contextual machine learning to analyse normal email behaviour and identify unusual activity.

For example, these tools can alert employees when they:

• Add an unexpected recipient to an email group.
• Attach the wrong document to a message.
• Attempt to send sensitive information to an unauthorised recipient.

By identifying potential risks before an email is sent, organisations can prevent mistakes without unnecessarily interrupting employees.

Technology like this forms part of the growing category of human layer security, which uses intelligent tools to identify and reduce the risks created when people interact with sensitive information.

Strengthen Access Controls and Data Protection

Making security tools easier to use is important, but organisations must also ensure that employees can only access the information they need to perform their roles.

Applying the principle of least privilege limits access to sensitive systems and data, reducing the potential impact of compromised accounts or inappropriate data handling.

Organisations should also use data loss prevention (DLP) controls to identify and restrict unauthorised transfers of sensitive information. Monitoring unusual data-sharing activity can help security teams identify potential problems before they develop into more serious incidents.

These measures should complement existing security policies rather than introduce additional complexity for employees.

Encourage Employees to Report Security Incidents

Finally, organisations need to establish a culture where employees feel comfortable reporting mistakes and potential security incidents.

A no-blame reporting culture is particularly important for employees like Confident Chloe, who might otherwise avoid reporting an incident because they fear criticism or professional consequences.

Employees should understand that reporting a mistake quickly is more important than trying to conceal it. Early reporting gives security teams a better opportunity to contain potential breaches, investigate what happened and prevent further data exposure.

This should be supported by compliance tools that provide visibility into security risks across the organisation and identify areas of non-compliance in real time. Security teams can then investigate problems and address weaknesses before they lead to further incidents.

Balancing Productivity and Data Security

Employees who take unnecessary risks with company data are not always acting maliciously. In many cases, they are trying to meet deadlines, manage workloads and complete their responsibilities as efficiently as possible.

However, when organisations make security difficult to follow or reward productivity without considering the risks, employees are more likely to bypass controls and expose sensitive information.

CISOs must therefore address both the human and technological factors behind insider threats. Security tools should support employees rather than obstruct their work, while workplace cultures should make data protection a shared responsibility.

Ultimately, businesses need to give employees the tools and support to get their jobs done without putting organisational data at risk.