Cyber security · Interactive model
The Security–Friction Dial
More rules feel safer, so leaders keep tightening. But every extra hoop pushes people to route around it — personal email, unsanctioned apps, a password on a sticky note. Drag the policy dial and watch two risks trade places: the one you control falls, and the one you can't see rises. Total risk is a U-curve, and the bottom isn't where most instincts point.
Direct risk (attacks that succeed)
Shadow-IT risk (workarounds)
Total risk
Anything goesBalancedDraconian
20strictness
—direct risk
—shadow IT
—total risk