Organisational Resistance

Why organisational resistance matters in security programmes

Organisational resistance is not just a change-management inconvenience. In security work, pushback often determines whether a control is approved, funded, adopted, or kept alive after launch, which makes resistance a direct factor in security maturity and control effectiveness.

Resistance commonly appears when a change adds visible effort without an immediately obvious business benefit. People may delay reviews, managers may hesitate to own new responsibilities, and governance groups may protect established processes even when those processes leave gaps in information security controls.

How resistance shows up in practice

The term covers several different behaviours, and they do not all look like open refusal. Some teams approve new tools in principle but never complete rollout, while others create procedural friction by requiring extra sign-offs, long exceptions, or repeated reviews that quietly slow the control change.

Because resistance can come from employees, managers, or governance bodies, it often blends cultural, operational, and political causes. The practical effect is the same: security work stalls, exceptions become normalised, and the organisation continues to depend on older control patterns that may be weaker than intended.

Security implications and control impact

In security programmes, resistance becomes important when it changes exposure. A delayed control can leave a known weakness unaddressed, and a rejected control can preserve risky behaviour such as informal approvals, manual workarounds, or inconsistent ownership of security tasks.

This is why organisational resistance should be read as a control-design signal, not only as a people issue. It often indicates that the proposed change is misaligned with incentives, too disruptive for the current workflow, or insufficiently connected to the risk it is supposed to reduce. Where the control depends on broad adoption, resistance can be the difference between a policy on paper and a control that actually functions.

How to interpret the term in governance and change discussions

For practitioners, the useful question is not whether resistance exists, but whether it is blocking a specific security outcome. That distinction helps separate ordinary debate from resistance that materially weakens a programme, such as repeated deferrals, exception sprawl, or a pattern of rejecting controls without an alternative safeguard.

When the topic is security governance, organisational resistance should be treated as part of the control environment. The issue is often not that people disagree with security in principle, but that the proposed change competes with local priorities, unclear ownership, or operational pain that was not addressed early enough.

Risk and Threat Considerations

Organisational resistance creates real security risk when it delays or prevents control adoption, because weaknesses remain exploitable for longer and exceptions can become normal operating practice. In mature programmes, the main danger is not loud opposition but quiet friction that keeps bad states in place.

Failure mechanism: Resistance slows approval, rollout, and enforcement, which gives existing vulnerabilities more time to persist and can leave security teams dependent on manual compensating controls.

Impact: The organisation may carry unresolved exposure, weaker accountability, and inconsistent control coverage, especially where the resisted change was meant to reduce access, secrets, or operational risk.

Practitioner Guidance

Common misunderstanding: Resistance is sometimes treated as a communication problem alone. In practice, it often reflects a control design problem, because people push back hardest when a new process adds friction without a clear ownership model or measurable reduction in risk.

Why practitioners should care: The most effective response is to tie the proposed change to the specific failure it prevents and to test whether the organisation can actually absorb the new workflow. If resistance keeps recurring, that is usually a sign to adjust implementation, ownership, or sequencing rather than simply asking for more buy-in.

Related resources from NHI Mgmt Group

• What is the difference between passwordless authentication and full ransomware resistance?
• What breaks when identity visibility lags behind organisational change?
• How should security teams implement passkeys without weakening phishing resistance?
• What is the difference between phishing resistance and secure rollout for passkeys?