A Gartner survey of 1,310 employees found that 69 percent had bypassed their organisation’s cybersecurity guidance in the past year. Another 74 percent said they would do so if it helped them achieve a business objective. CISOs are expected to deliver both total security and zero friction, but employees are already making their own trade-offs.
A Mandate With a Built-In Contradiction
Most boards and executive teams expect the organisation to stay safe without slowing anyone down, even if they never put it in writing. Every control that stops an attacker also imposes a cost on legitimate users, whether through extra logins, approval queues or restricted tools. Security and friction are not objectives to be maximised together. They are a trade-off, and the CISO is accountable for both sides.
The Gartner data shows what happens when leaders ignore the trade-off. Friction that slows people down drives them to insecure workarounds, which Gartner analysts now call a major source of insider risk. A control that employees bypass does not protect the business and hides the risk from view. The same pattern is emerging with artificial intelligence: a 2025 Gartner survey found that 69 percent of organisations suspect or know that staff are using prohibited public generative AI tools.
The Pressure Lands on One Person
Industry surveys, despite differences in method and sponsorship, consistently point to the human cost. A 2025 Proofpoint report found that 94 percent of CISOs said job stress was affecting their performance, and 63 percent had experienced or seen burnout that year. Another survey reported by Help Net Security found that 44 percent of CISOs named board and executive expectations as their top source of stress, ahead of external threats. Nearly half said burnout had already reduced their ability to prepare for breaches.
The job’s structure compounds the problem. Organisations now run more than 75 security products on average, yet cybersecurity spending has dropped to 6.4 percent of IT budgets, according to a 2025 industry primer. That same primer found that 78 percent of board members see cyber reports as too technical to link to business outcomes. More than half of CISOs in the Help Net Security survey said they lack standardised, business-focused metrics. They are held accountable in business terms, but often lack the tools to report in those terms.
The Problem Is Unplaced Friction, Not Friction
It is easy to argue that security should step aside, but the data does not support that view. Most CISOs in the survey had faced a major incident within six months. The threat is real and persistent. The practical answer is to place friction deliberately. Strong controls are needed where failure has serious consequences: privileged access, payments, sensitive data. Approval steps on low-risk activity are bypassed; approval starts, and each unst in the contrerodesatter.
What a Workable Mandate Looks Like
Replace the unspoken mandate with an explicit one. Executives and the CISO should agree where friction is acceptable and where it is not, and document that decision as a risk appetite the entire leadership team owns.
Report in business terms. Trend lines that show whether risk is rising or falling, and clear links from incidents to operational impact, give boards actionable information and give CISOs a fair basis for judgment.
Share the accountability. RSAC expects personal legal exposure for US CISOs to ease from 2026 as the SEC narrows its enforcement focus, but still advises CISOs to agree protections with their general counsel and HR. A leadership team that asks one person to carry liability for risks it collectively chose has misunderstood the job.
Total security with zero friction is not possible, and no CISO can deliver it alone. The board is the only group that can set an honest mandate about the trade-off.
How does your organisation decide where security friction is acceptable and where it is not?
