What: Six experiments with more than 2,800 participants show that restrictive cybersecurity policies can make employees downplay the severity of cyber threats, while giving them choice within mandatory rules and explaining the risk when lifting a ban reduces the effect.

Why it is important: With AI-enabled attacks already widespread and AI controls still minimal, restrictions that make employees doubt the risk undermine the security measures meant to protect organizations.

Generative AI and a fast-changing menu of workplace apps have changed how employees work, and bans often push use out of sight rather than end it. In a 2025 KPMG and University of Melbourne study, 57% of workers said they had hidden their AI use and 48% said they upload company data into public AI tools. Verizon's 2026 report found shadow AI detections quadrupled in one year.

Across six experiments with more than 2,800 participants, the authors find that restrictive policies weaken belief in cyber threats in two ways. Rules that feel overbearing trigger psychological reactance, and employees then deny the threat is serious; mandatory training produced the same effect, but offering choice over format and timing within the requirement reduced it. Lifting a policy, such as a generative AI ban, leads employees to infer the risk was exaggerated, though explicitly reaffirming the remaining risk largely offset this.

The authors propose five principles: give employees choice inside the guardrails, make the secure path less aversive, explain the threat before imposing the control, plan the exit before imposing a ban, and measure beliefs as well as compliance.

IADS Notes: Shadow AI is already documented as a governance gap rather than a policy gap. RH-ISAC, September 2026 found that AI-related data exposure now outranks ransomware and phishing as the top concern among 201 retail and hospitality CISOs, even though only 3% of surveyed organizations have no AI policy, and it identified slow approval processes as the reason unsanctioned use persists. The wider readiness gap shows in Harvard Business Review, October 2026, where 89% of organizations report AI-enabled attacks while most run only minimal AI-specific controls, and clear rules on employee AI use feature among the recommended steps. Oversight needs grow as tools become more autonomous: IAPP, December 2025 called for least-privilege access, comprehensive logging and human review at critical decision points for AI agents. On the human side, BCG, December 2025 framed AI adoption as much a human challenge as a technical one, relying on clear roles and shared ownership across teams.

When restrictive cybersecurity policies backfire