Security incentives

People optimise for what they are measured on, and security is rarely on the list.

An engineer judged on delivery will deliver. Asking them to also carry security work that no one measures, against deadlines that do not move, produces compliance theatre. Changing behaviour means changing what is counted, which is an organisational decision rather than a security one.