Why do people not follow security procedures?

When a security procedure is not followed, the explanation is not necessarily a lack of knowledge or awareness.

Difficult workflows, technology, competing demands and organisational constraints all play a role in how people act.

Behaviour analysis should therefore look at the interplay between people, technology and organisation before interventions are decided.