An employee was caught using DeepSeek, an AI tool not approved under company policy. Were they deliberately bypassing security guidelines—or just unaware of the rules? Situations like this happen all the time in cybersecurity—an employee downloads unauthorized software, IT forgets to apply a critical patch, or a colleague shares sensitive data improperly. Our instinct often leads us to assume malice or bad intentions. But what if there's a simpler explanation?

Enter Hanlon's Razor, a mental model that states:

"Never attribute to malice that which is adequately explained by incompetence."

In other words, before assuming someone is acting out of ill will, consider the possibility that it was an honest mistake, oversight, or just human error. This principle, attributed to Robert J. Hanlon, is a valuable tool for interpreting situations with a more rational and constructive mindset.

Why Hanlon's Razor Matters in Cybersecurity

In cybersecurity, threats are everywhere, and human error remains one of the most significant vulnerabilities. Assuming malicious intent behind every security lapse, we risk creating a culture of blame rather than learning. Instead, applying Hanlon's Razor can help us:

  • Improve security awareness: Many breaches occur due to a lack of training or awareness rather than intentional negligence.
  • Encourage proactive security measures: Instead of assuming insiders act maliciously, organizations can focus on education and better safeguards.
  • Foster a culture of learning: Mistakes in cybersecurity are opportunities to improve processes rather than immediately attributing them to malicious intent.

The CISO's Dilemma: Smart or Risky?

While Hanlon's Razor encourages a more forgiving perspective, security leaders must ask: at what point does repeated incompetence become negligence?

For Chief Information Security Officers (CISOs), applying Hanlon's Razor can be a double-edged sword. On the one hand, fostering a learning culture and assuming incompetence over malice can build trust and encourage open discussions about security improvements. On the other hand, over-reliance on this principle may lead to missed warning signs of insider threats, negligence, or sophisticated attacks disguised as mistakes.

So, is embracing Hanlon's Razor a smart or risky approach for a CISO?

  • Smart: It reduces unnecessary panic, prevents knee-jerk reactions, and promotes a culture of continuous improvement in security awareness.
  • Risky: It can lead to complacency if security leaders fail to recognize real threats hiding behind repeated "mistakes."

Applying Hanlon's Razor with Caution

  • Pause before reacting: When a security issue arises, ask yourself, "Could this be incompetence rather than malice?" but don't dismiss malice outright.
  • Consider the person: Apply the legal "reasonable person standard," which refers to a hypothetical person of average prudence and caution used to determine if someone acted negligently in a given situation; essentially, whether a reasonable person would have acted the same way under similar circumstances. 
  • Consider the extent: Was the mistake egregious and impacting multiple elements, or was it limited in nature? The latter might be more nefarious, whereas the former tends to indicate incompetence.
  • Consider the data/system affected: Did this occur in a production or test environment? Did it get close to compromising your company's crown jewels or just a subset of internal company data?
  • Conduct thorough investigations: Avoid jumping to conclusions by assessing the root cause of incidents while staying alert to repeated patterns of negligence.
  • Balance education with accountability: Proper education and structured procedures can prevent many security mishaps, but repeated lapses may signal deeper issues.

Hanlon's Razor in Action

Over the past decade, I've switched my approach to starting with Hanlon's Razor, and thankfully, I have yet to be proven wrong. One memorable event was when a new employee sent a spreadsheet containing very sensitive company data to their personal email. This caused our DLP control to light up like a Christmas Tree. Investigation showed this was a triple case of Hanlon's Razor in action.

First case: The new employee was not aware

The file that the employee sent was a sample spreadsheet from their first-day training materials. Initially, the file didn't visibly contain any sensitive data. However, upon further inspection, the sensitive data was in hidden columns. Applying the "reasonable person" principle, we could not expect a new employee who was not yet fully aware of all company policies, standards, and processes to recognize this issue. Furthermore, the employee still lacked secure remote access to the training environment. When they asked the instructor if they could send the file to a personal email to continue training, the instructor said yes.

Second case: The training center was not aware that the file contained sensitive data

The training center received the file from the data custodian and used it as-is, assuming it did not contain sensitive data. Additionally, they were unaware that training materials are technically considered company data (albeit at a lower classification level) and should not be emailed to personal accounts.

Third case: The data custodian wasn't aware of proper process

The data custodian did not fully understand their responsibility for properly sanitizing the file before providing it to the training center. They assumed the training center would cut and paste data rather than share the file when developing course materials.

Conclusion: It was not a breach but an opportunity to improve

When the investigation concluded, we took the following actions:

  1. We thanked the employee for helping us uncover this issue and used it as an educational opportunity.
  2. We updated training center processes, ensuring all new employees had secure remote access before starting training. We also resequenced training modules to prioritize security and privacy topics first.
  3. We clarified the Data Sanitization Process for all data custodians and implemented internal DLP controls to prevent similar issues in the future.
  4. We leveraged the incident to advocate for stronger DLP policies, emphasizing stricter controls to prevent sensitive data from crossing company boundaries. Had this been a malicious act, the data would have already been outside our control. We were lucky this time, and it reinforced why proactive security is so much better than reactive security.

Final Thoughts

Hanlon's Razor is a powerful tool for reducing stress, improving security practices, and fostering a culture of learning rather than blame. However, CISOs must strike a delicate balance—assuming incompetence before malice while staying vigilant for genuine threats.

Next time you encounter a security issue, ask yourself: Was it really malice or just incompetence? More importantly, Can I afford to be wrong?

I'll add a poll here (If LinkedIn Allows me to do so).

Either way, I'd love to hear your thoughts on this.