Cybersecurity Policies No One Reads Are Useless
- Esteffan Coetzee
- 5 hours ago
- 2 min read
Every company has cybersecurity policies. They sit in a dusty corner of the intranet, buried under 47 other PDFs that no one has ever opened. And when a security incident happens? No one remembers what they’re supposed to do.
You can write the most airtight security policy in history… but if no one reads it, you might as well print it on toilet paper — at least then it’d get some use.
1. The Problem with Most Cybersecurity Policies
Companies love writing security policies.
20 pages long.
Full of legal jargon.
Impossible to find when you actually need it.
And here’s the kicker—employees don’t read them.
💡 Example: A global company did an internal survey and found that less than 10% of employees had ever read the cybersecurity policy. When asked why, the answers were brutal: |
“I didn’t know where to find it.”
“It’s too long.”
“I just assumed IT handled that.”
A security policy that no one reads, understands, or remembers is completely useless.
2. Why Security Policies Fail (and How to Fix It)
They’re Too Long
Nobody is reading a 20-page document to figure out if they should report a phishing email.
✅ Fix it: Keep it short and to the point. If it can’t fit on one page, it’s too long.
They’re Too Complicated
If your security policy sounds like a compliance manual written by a lawyer, it’s DOA.
✅ Fix it: Use plain, simple language. Employees don’t need a lecture on “multi-factor authentication best practices” — they need to be told "Turn on MFA. Now."
No One Knows Where to Find Them
What good is a security policy if no one can find it?
✅ Fix it: Make it accessible—not hidden in some forgotten SharePoint folder from 2015.
No One is Reminded of Them
A security policy employees read once and forget is as useful as an umbrella in a hurricane.
✅ Fix it:
Put key policies into onboarding.
Repeat important messages in security training.
Display simple, visible reminders—on login screens, in emails, and even on posters.
3. What Good Security Policies Actually Look Like
If you want employees to follow security policies, they need to be:
1️⃣ Short and Clear
Instead of: “Utilizing password entropy best practices is recommended to ensure credential security.”
Say: “Use a password manager. Don’t reuse passwords. Enable MFA.”
2️⃣ Practical and Actionable
Instead of: “Employees must exercise caution when handling digital communications from unknown entities.”
Say: “If an email looks suspicious, don’t click—report it.”
3️⃣ Easy to Find & Reinforced Regularly
Instead of: “Please refer to Appendix B, subsection 4.3 for phishing guidelines.”
Say: “Click the ‘Report Phishing’ button in Outlook if an email looks dodgy.”
Final Thought: If Employees Can’t Find, Understand, or Remember Security Policies, They Won’t Follow Them
The best security policy in the world is useless if it’s:
🚩 Too long
🚩 Too complicated
🚩 Impossible to find
🚩 Never reinforced
Want security policies that actually work?
✅ Make them short.
If it doesn’t fit on one page, rewrite it.
✅ Make them clear.
No corporate fluff—just what to do, what not to do, and why.
✅ Make them visible.
A security policy hidden in a PDF no one opens doesn’t exist. Because in a real cyberattack, no one has time to read your 20-page policy manual. 🤙