This week the Dutch intelligence agency AIVD warned about a new type of risk: the security-avoiding insider. Not an employee acting with malicious intent, but someone who, knowingly or not, bypasses security measures because they slow down their work. A door propped open with a piece of tape. A password written on a note under the keyboard. A file sent through a personal email account because the company system responds too slowly. For AIVD this is not a one-off incident but a pattern. For you as a business owner, it raises a more useful question: what does this behaviour tell you about how security is actually set up in your company?
Not malice, but a signal
When someone bypasses a measure, the first reaction is often to tighten the rules or ban the workaround outright. That is understandable, but it misses the point. An employee who finds a shortcut almost always does so because the official route does not work the way it was designed to. The scanner logs out constantly during a busy shift. The secure planning app loads slowly on an old phone in the delivery van. The second login step is awkward with work gloves on. The result is that people invent their own practical solution, usually without realising they are opening up a risk in the process.
Where this shows up in your business
In wholesale, this often shows up as shared login codes on the warehouse floor, because everyone uses the same scanner during a shift and logging in separately costs time. In transport and logistics, a route or delivery time sometimes gets shared through a messaging app instead of the secure planning tool, simply because it is faster between two stops. In manufacturing, a second authentication step is occasionally skipped at the machine because the operator has just washed their hands and has no patience for an extra step. None of these people are thinking about risk. They are thinking about getting their work done.
What is actually at stake
The risk is not only a possible data breach, although that alone is reason enough to take this seriously. It also affects how well you can demonstrate towards NIS2 that your security is under control. A policy on paper that is routinely bypassed in practice does not help you there. In fact, it shows a gap between what you think you have arranged and what is actually happening. That gap is exactly what an auditor, an insurer, or an incident will eventually ask you about.
Measure first, then act
The instinct to immediately introduce stricter rules or more technology makes sense, but it backfires if you do not first understand where and why people are bypassing measures. Start by mapping out what behaviour actually occurs. Where is a password being shared. Which app gets ignored in favour of something more convenient. Which step in a process is routinely skipped. You will not get that picture from a policy document, but from conversations with team leaders and from behaviour you can trace in your systems. Only once you know what is really happening can you decide whether policy needs to change, technology needs adjusting, or people need to be brought along first.
Policy that fits the shop floor
Policy that is written behind a desk and never tested on the shop floor almost always loses out to daily practice. So ask the people who work with it every day what does and does not work, before you make something mandatory. A warehouse worker telling you that logging in takes too long during a peak period gives you a concrete problem to solve, for example with a faster login method instead of a flat ban. That is how security becomes something people go along with, instead of something they try to avoid.
What you can do this week
This week, talk to a few team leaders or shift supervisors and simply ask where security measures get in the way. Then look at which three measures are bypassed most often, and why. Discuss those findings internally before drafting new rules, and involve the people affected in finding a solution. It costs you an afternoon, and it delivers more than a new policy document nobody reads.
A few questions we’re often asked
Is a security-avoiding insider the same as a malicious insider?
No, and that distinction matters. A malicious insider acts deliberately against the company’s interest, while a security-avoiding employee is actually trying to do their job and unintentionally opens up a risk along the way. The response differs completely: with one you intervene, with the other you start a conversation.
Should I now add extra monitoring of employees?
That is usually not the first step. Before adding monitoring, it is far more valuable to understand why people are deviating from policy. Extra monitoring without that understanding often just leads to new, smarter workarounds.
How do I know if this is happening in my company?
You usually recognise it in small things nobody flags as a problem: a shared password treated as normal, a regular habit of working around a system, or a remark like ‘we never actually do it that way’. A short conversation with a few people on the shop floor often reveals this faster than an extensive audit.
What does this have to do with NIS2?
NIS2 does not just ask for policy on paper, it asks you to demonstrate that policy actually works in practice. A measure that is routinely bypassed is hard to demonstrate towards regulators or clients, no matter how neatly it is described in a document.
Curious where security measures are being bypassed in your company, and why? We’re happy to help you map that out first, before you draft new rules.
