Why Do Organisations Keep Investing in Technology Instead of Behaviour?

By Tobias Ander

Organisations fund technology more easily because it fits existing budgets and ownership structures, while security behaviour cuts across functions and management lines.

When organisations face a cybersecurity problem, the response often starts with technology. That is not because leaders think people are unimportant. Technology simply fits familiar management structures: it can have an owner, a budget, a supplier and a delivery date. Behaviour is harder because it is shaped across the organisation.

Having worked as CISO in the Swedish Armed Forces and the Swedish Transport Agency, I have seen how much that difference matters. The technical control is often the easier part. The harder question is what happens around it once people are under pressure to get the work done.

Why is technology easier to govern?

A new security platform is straightforward to turn into a project. Someone writes the business case, suppliers are compared, money is allocated and implementation can be tracked. When the system goes live, management can point to something that has been delivered.

Trying to change security behaviour is less tidy. The security team may own policies and awareness. HR influences management expectations and incentives. Operational leaders decide how work is actually done. Senior management decides what happens when security competes with speed, cost or customer delivery.

There is rarely one owner for all of that.

The UK National Cyber Security Centre describes security culture as being shaped by an organisation’s goals, structure, policies, processes and leadership. Its board guidance also stresses that senior leaders set the tone through their own behaviour. Culture is therefore not something the security team can deliver on its own.

That helps explain why technology so often wins the investment argument. Organisations are good at funding things that fit existing structures. Behaviour often falls between them.

Who owns behaviour when security gets in the way?

The ownership problem becomes visible when a control makes sense on paper but creates friction in practice.

A company may tell staff to use an approved system for sharing sensitive information. If that system is slow or awkward, some people will look for another way to finish the task. A business may prohibit public AI tools while also expecting teams to improve productivity with AI. The policy and the operational pressure are then pulling in different directions.

I saw versions of this problem in very different environments as a CISO. A control could be entirely reasonable from a security perspective and still collide with the way work needed to be done.

What matters is what the organisation learns from that collision.

If management treats every workaround as evidence that employees need more training, it may miss why the workaround appeared. The problem might be carelessness. It might also be a slow approval process, a badly chosen tool or a manager who has made delivery more important than following the control.

This is why I am cautious about calling people the weakest link. People make mistakes, but they also respond to the environment around them. When the same insecure behaviour keeps appearing, leaders should look at the conditions producing it.

What do the numbers really tell us?

Technology has another advantage: it generates metrics that are easy to report.

Boards can see how many systems are patched; how many attacks have been blocked and how much has been spent. The human side of cybersecurity is often pushed into the same reporting model. We count training completion, phishing simulation results and awareness activities because they are easy to count.

Those measures have value, but they do not automatically show that behaviour has changed.

The UK government’s Cyber Security Breaches Survey 2025/2026 found that cybersecurity was considered a high priority for senior management in 72% of businesses. Across businesses overall, 31% had a board member taking explicit responsibility for cybersecurity, rising to 52% among medium businesses and 68% among large businesses.

Those figures do not tell us whether an organisation has a strong security culture. They do show that describing cybersecurity as important is not the same as giving it clear ownership.

Leaders need other signals as well:

• Where are people regularly working around our security processes, and why?
• What happens when somebody reports a mistake?
• Which behaviours are we actually trying to influence?

These questions are harder to reduce to a dashboard. They are also closer to the way security works in everyday operations.

What should leaders invest in differently?

The answer is not to create a new budget line called “security culture”. That would make it too easy to turn culture into another programme owned by somebody else.

A better approach is to consider behaviour when technology, processes and performance expectations are designed.

Before introducing a new control, leaders should ask how it will affect the people expected to use it. Will it make the secure option easier or more difficult? What is likely to happen when operational pressure increases? Do managers reinforce the behaviour the control depends on?

This reaches well beyond awareness programmes. The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 76% of highly cyber-resilient organisations involved the security function in procurement, compared with 53% of organisations assessed as insufficiently resilient.

Procurement is not normally described as a security culture activity. That is precisely why the example is useful. It shows what happens when security is built into ordinary business processes instead of being added afterwards.

The same principle applies elsewhere. Security becomes more durable when it is part of the way the organisation makes decisions.

What needs to change?

Organisations keep investing in technology because technology fits the way they already allocate money, ownership and attention. Behaviour does not fit as neatly.

That is not a reason to buy less technology. It is a reason to widen the investment discussion.

When a security problem appears, leaders should still ask which technical controls are missing. They should also ask what in the organisation made the problem possible, whether the current incentives encourage the behaviour they want, and who owns the outcome after the implementation project is finished.

If the answer to every security problem is another product, part of the risk may remain exactly where it was.

About the Author

Tobias Ander is a Swedish information security leader and senior advisor specialising in information security culture, governance and human-centric security. Founder of Securebyme AB, Tobias advises executives, government and enterprise leaders. He has served as CISO for the Swedish Armed Forces, Swedish Transport Agency and municipalities. He is author of Information Security Culture: The Missing Layer of Cyber Defence, publishing on 01 October.