Organisations routinely add controls such as flood barriers, multi-factor authentication, GPS, autocorrect and AI assistance to make systems safer and easier to use.
Organisations routinely add controls such as flood barriers, multi-factor authentication, GPS, autocorrect and AI assistance to make systems safer and easier to use.
Every successful control changes behaviour. As people feel safer, they may pay less attention to the original risk or accept risks they previously avoided.
This is the logic of risk compensation: when a system feels safer, behaviour adapts. The control solves one problem, but human psychology can quietly create another.
Leaders can overestimate the protection provided by a control if they assess only the technology and ignore how people will behave differently once it exists.
Never evaluate a control in isolation. Ask how behaviour, attention and risk-taking will change because the control now exists.
The point is not that safety technology is bad. It is that no control is behaviourally neutral.
Matt White is a behavioural translator, author of The Snack Monkey, and Director of Cyber Advisory and AppSec. Available for keynotes, workshops and media commentary. Get in touch.