It happens because cybersecurity teams do not design for efficiency and believe that security trumps everything else. If they understood that security, just like anything else, is there to drive the business, they'd perhaps sit down with people doing the work. And then figure out how hard it is to share a simple file or a photo, take it to the print shop as one can't plug in their private USB stick, or how annoying it is to develop Linux IoT firmware on WSL, or how annoying it is to get logged out every 2h.

Because unless you do, people will adopt behaviour that makes them productive, and instead of increasing security, your policies will drive it down.

This is not a result of "bad employees": this is a result of bad security policies.

No security works unless it is enforced and there are severe consequences

> Marketing team sharing credentials

Fireable offense, immediate firing first time this happens, won’t happen again after that, both of person who shared the credentials and person who used the shared credentials

> Sales MFA

Prevent login without it, let them bitch about it for a week

> API keys in repos

Fireable offense not just for commiter but entire team

Well, that's because somewhere between the executive team, which "gets it", and "three levels down"... somewhere between 1 and 2 levels down, there is a team that translates "security" into some compulsory training, scanning internal software/apps/libraries/libraries using crappy automated vendorware, and counterproductive/arbitrary password requirements.

After that, "security" starts to mean "ticking all the boxes to keep the scan happy and stay off the report" (even if the scans are wrong, out of date, littered with false positives, and lacking the ability to find basic problems) and stops having anything to do with actually being secure.

"..teams not design..efficiency.."

Enough truth in that.

Need hours back and forth w/the end user, moderately sophisticated UX designers (eg. empathy, anybody?) user education (not mandates) and training, an actually useful help desk, efficient equipment... And real time graduated enforcement that impacts all levels, not just the bottom level perp-scapegoat.