Cyber security · Interactive model

The Security–Friction Dial

More rules feel safer, so leaders keep tightening. But every extra hoop pushes people to route around it — personal email, unsanctioned apps, a password on a sticky note. Drag the policy dial and watch two risks trade places: the one you control falls, and the one you can't see rises. Total risk is a U-curve, and the bottom isn't where most instincts point.

Direct risk (attacks that succeed) Shadow-IT risk (workarounds) Total risk
Anything goesBalancedDraconian
20strictness
direct risk
shadow IT
total risk