Process Over Top-Down Enforcement: How to Empower Employees to Prevent Data Leaks

When it comes to safeguarding data, are humans a vulnerability or an asset? The answer very much depends on how organisations empower and enable their teams to deal with the many regulations and policies that define their cybersecurity strategy. In the push to strengthen data security, many workers are beginning to feel disillusioned or overwhelmed by complex security rules that appear to serve the business rather than serve them as employees. When rules are enforced without adequate support in the form of new technologies and safeguards, the data security burden lies firmly on the shoulders of the employee, and the time and energy required to carry that burden can start to feel like a barrier to productivity.

This disconnect is echoed in recent research from Zivver, which shows that 51% of IT leaders identify employee awareness as their top security challenge, and 38% report difficulties in fully engaging employees with security practices. This isn’t about apportioning blame, but accepting the frustrations felt among employers and employees in the pursuit of a common goal. It isn’t the individuals that warrant scrutiny, but the processes under which those individuals are expected to thrive. Zivver’s research also highlights several key barriers impacting employee focus and productivity, with 41% of respondents citing excessive bureaucracy, 27% pointing to time-consuming security protocols, and 26% identifying an overload of IT systems as significant roadblocks to getting things done securely.

When security processes are inadequate or begin to feel like a hindrance, workers tend to look for shortcuts, often inadvertently exposing their organisations to risk. In fact, while inbound threats like ransomware tend to grab the media headlines, accidental human error accounts for more than 80% of data leaks. It’s clear that a fresh approach to cybersecurity is needed – one that supports and empowers employees to make the right decisions, and embeds security policies into day-to-day operations instead of expecting employees to jump through numerous hoops.

The question here is, how can IT leaders encourage a security-first mindset that does not depend on complex manual steps or disruptive processes, but rather integrates data protection into everyday tasks in a way that makes security feel second nature?

Data leaks: Human error, but not a human problem

While malicious inbound threats often dominate conversations around cybersecurity, it’s important not to overlook the impact of human error—one of the most common causes of data leaks. Employees aren’t just at risk of making mistakes due to negligence; they’re often under pressure to meet tight deadlines, manage heavy workloads, and keep pace with a growing list of security protocols. Both Anita and Sue noted that in fields such as healthcare and legal services, where efficiency and speed are paramount, security measures can feel like obstacles rather than safeguards. When people feel rushed or overwhelmed, the chances of errors multiply.

Human error is particularly common in data handling tasks like email, where autocomplete features, large attachments, and sensitive information are everyday concerns. As Anita points out, in the legal sector, data from the UK’s Information Commissioner’s Office indicated that last year, 4.2 million people were potentially affected by law firm data breaches, with over half of those incidents tied to human error. These incidents could be caused by anything from relying too much on the autocomplete in an email address field, to accidentally emailing the wrong John or Jane at a third-party supplier or partner. This is an industry-wide issue, but it’s one that can be reduced by creating a work environment where secure practices are easier to follow than to bypass.

Anita went on to highlight that rather than viewing employees as a liability, organisations can instead treat them as their greatest asset in data security. When the right tools and processes are in place to support employees, they are more likely to follow secure practices without feeling burdened. Sue agreed: the focus should be on equipping people with simple, accessible tools that make it easy to do the right thing, reducing the reliance on manual vigilance and minimising the risk of errors.

Security by process, not by enforcement

For cybersecurity measures to be effective, they need to feel like a natural part of employees' daily routines. When security protocols add too much friction, employees are more likely to find workarounds, potentially increasing risk. Sue emphasised that in sectors where urgency is high such as healthcare, where split-second decision-making can sometimes mean the difference between life and death, employees are quite right to consider cybersecurity as secondary to their immediate tasks. This isn’t an employee problem, but a process problem. While some industries such as IT may view cybersecurity as core to their everyday responsibilities, there are countless sectors where cybersecurity is not – and shouldn’t be – the primary focus.

Anita discussed the value of tailoring security tools to meet the unique demands of different roles within an organisation. Instead of expecting employees to navigate a blanket set of rules, organisations can adapt security protocols to fit the specific tasks employees perform, considering the types of data they handle and the workflows they rely on. By integrating security steps directly into these workflows, companies can promote secure practices that require less effort to follow and don’t interrupt productivity.

Making security second nature

The role of automation in cybersecurity is rapidly becoming more critical, especially as organisations seek to reduce the pressure on employees to manually enforce security protocols. When automated tools are embedded into commonly used applications, they can proactively flag issues and prevent errors before they happen. Sue explained that tools capable of scanning emails for sensitive information or identifying potential recipients who shouldn’t receive certain data can help employees stay compliant without extra effort.

User-friendly tools that integrate seamlessly into daily workflows also minimise the need for manual intervention, which can often be a weak point in security processes. As Anita highlighted, automation stops employees having to remember each individual protocol or check every single detail, especially when they are managing large volumes of data. Tools that operate quietly in the background—flagging risks, providing real-time feedback, and securing data without interrupting work—allow employees to focus on their core responsibilities without compromising security. This approach helps eliminate workarounds and reinforces secure habits, creating a safer environment where data protection becomes a shared, manageable part of the workday rather than another set of chores to deal with.

Positioning security as a boardroom priority

When it comes to stakeholder buy-in, how do those with a vested interest in an organisation’s security practices convince C-suite executives and key decision-makers to invest in security

automation and security intelligence tools? Anita made the point that different “audiences” will require different approaches to the conversation. For instance, emphasising the return on investment (ROI) of strong data protection practices can help persuade the CFO, while stressing the role of cybersecurity in building trust and safeguarding the organisation’s reputation may appeal more to the CEO. Tailoring the message to each audience reinforces that cybersecurity is not just a technical issue—it is a strategic concern that impacts the entire organisation. When senior leaders understand the broader benefits, they are more likely to support initiatives that embed security into the organization’s culture. This, in turn, encourages a top-down commitment that empowers employees and aligns all levels of the company with the same goals.

By framing data security as essential to stability, growth, and reputation, organisations can foster a proactive approach that goes beyond regulatory compliance, ensuring that cybersecurity practices are not only adopted across departments but are also viewed as a fundamental part of the organisation’s resilience and success.

https://www.zivver.com/lp/webinar-empower-people-to-prevent-data-leaks