As cyber threats soar employers have been told that empathy, not just technology, can be a powerful defence against insider risks.

Scientists say while most organisations address cybersecurity issues with technology and surveillance, empathy may be a more effective defence.

A new study by Emmanuel Anti, project researcher at the University of Vaasa  found insider threats and deviance occur when employees, contractors or former staff misuse their access to an organisation’s systems – either deliberately or by accident.

Anti’s added people do not always plan to break the rules. Unintentional acts like sending confidential emails to the wrong person or falling victim to a phishing attack may arise from the same root causes, such as stress, pressure and an unsupportive work culture, Anti explains.

Some employees also display so-called “deviant creativity” – finding clever and novel ways to bypass security restrictions. Using insider knowledge in clever but risky ways can expose the organisation to cybersecurity threats. For instance, an employee might email sensitive files to their personal account to save time and finish work off-site, knowing the system won’t flag unclassified data or block personal addresses.

– When security systems and policies are too rigid, employees create workarounds. To strengthen compliance and security culture, organisations must first understand what motivates people to bypass the rules, Anti says.

He added traditionally, organisations have relied on technological tools to manage insider threats, but Anti argues this approach fails by ignoring the human element. Today’s tools, including AI systems used to monitor employees, can misread work quality, rewarding speed over care and branding thoughtful, careful workers as inefficient. Over time, this can create frustration, strain, and mistrust.

“Rather than preventing insider threats, these tools can help cause them,” Anti explained. “Insider deviance becomes a reaction to emotional, contextual, and environmental pressures.”

His research proposes an alternative: an empathetic security model grounded in design thinking. This approach encourages organisations to co-create cybersecurity policies with employees, focusing on understanding their needs, motivations and emotional well-being.

“Empathy builds trust. When employees feel understood, they are more likely to report mistakes instead of hiding them, and to follow security rules because they helped create them,” Anti concluded.