Malice And Ignorance Can Mix

There are a lot of well-intentioned reasons that an employee might knowingly fail to fully follow the rules.

Rather than focusing on malicious attacks, security policies should acknowledge the fact that many employee-driven breaches stem from an attempt to balance security and productivity. This means educating employees and managers on the prevalence of non-malicious violations and providing clear guidance on what to do if adherence to security practices seems to conflict with getting work done.