Description:

Security doesn’t fail in policies—it fails in people’s everyday decisions. This thesis explores why employees ignore, bypass, or misunderstand security controls even when they want to do the right thing. You’ll build a model that explains how security policies turn into real workplace behavior, and identify where the policy, control and compliance chain breaks (e.g., time pressure, confusing rules, friction, habituation, incentives).