People often have rational justifications for why they don't follow the cybersecurity policies.
Karjalainen M., Sarker S., & Siponen M. (2019), 'Toward a Theory of Information Systems Security Behaviors of Organizational Employees: A Dialectical Process Perspective', Information Systems Research, vol. 30, no. 2, pp. 687-704, https://doi.org/10.1287/isre.2018.0827