If Leadership Doesn’t Care About Security, Neither Will Employees

Article summary: Employees take their cues on what actually matters from what leadership does, not just what the employee handbook says. When executives skip multi-factor authentication or wave off a policy “because it’s slowing us down,” that signal spreads through the business faster than any training module. Leadership and security culture are tightly linked, and fixing one usually starts with fixing the other.

An employee notices the owner reusing the same password across a dozen accounts. Another sees a manager forward a client file through a personal email account to save a step. 

Neither of these moments comes with an announcement, but both send a message louder than any security awareness training session: this stuff is optional if you’re important enough.

Why Employees Copy What Leaders Do, Not What They Say

People read behavior, not policy documents, to figure out what actually gets rewarded or ignored.

A 2025 study published in Information Systems Frontiers examined how leadership behavior shapes employee compliance with information security policy, and found that the way leaders act, not just what they announce, is what predicts whether employees actually follow security rules.

This isn’t unique to cybersecurity. It shows up anywhere rules exist alongside power. But security has a particular problem: violations are often invisible until something goes wrong, so a leader who cuts corners rarely faces any immediate consequence. 

That silence gets read as permission, and it’s how weak leadership and security culture end up reinforcing each other over time.

The same study found that two distinct leadership styles produce different outcomes. Leaders who simply enforce rules get baseline compliance at best. 

Leaders who actively explain the reasoning behind a rule and visibly follow it themselves get employees who internalize the habit rather than just tolerating it. The difference isn’t the policy. It’s how the leader shows up around that policy, day after day.

The Research on Why This Keeps Happening

Gartner’s research on driving secure employee behaviors identifies low executive support as one of the clearest signals that an organization doesn’t treat security risk as core to business success, alongside compliance-only thinking and weak industry maturity. 

Employees in these organizations pick up on that signal quickly, even without being told directly.

67% of organizations report fewer security incidents after implementing consistent security awareness training.

Fortinet’s 2025 Security Awareness and Training Global Research Report found that training works, but also flagged visible leadership support as one of the practical factors separating programs that actually change behavior from ones that don’t. Training alone isn’t the differentiator. Whether people believe leadership means it is.

What “Leading by Example” Actually Looks Like

It’s tempting to think a memo or one all-hands meeting solves this. It doesn’t. ISACA’s guidance on transforming cybersecurity culture recommends leaders make their own security actions visible — reporting their own mistakes and discussing security concerns openly in leadership meetings, rather than leaving it to IT. 

A few concrete habits go a long way:

• Use multi-factor authentication on every account, including the owner’s, with zero exceptions carved out for convenience.
• When a leader clicks a suspicious link or falls for a test phish, report it out loud instead of quietly resetting the password.
• Bring up a recent phishing or fraud attempt in a regular team meeting, not just during annual training.
• Ask about security risk before approving a new vendor or tool, out loud, in front of the team making the request.

None of these require a budget. They require leadership treating security as something they participate in, not something they assign.

Small Businesses Feel This Even More

In a small business, there’s no layer of middle management to buffer the owner’s habits from the rest of the team.

 What the owner does is what the culture is, full stop. In a 200-person company, a careless regional manager might get diluted by other leaders modeling better habits. In a 10-person company, there’s no dilution. Leadership and security culture are essentially the same thing.

CISA’s Cyber Essentials guidance makes this explicit for small organizations, framing the business leader as the person responsible for driving cybersecurity strategy, investment, and organizational culture, not a delegate. That’s not a suggestion. It reflects how small teams actually behave.

This cuts both ways. A distracted owner drags the team’s habits down fast, but one who takes access reviews and basic hygiene seriously sets a standard the team can live up to — no dedicated security department required. In a small business, a strong security culture often costs nothing more than consistency. 

Want an Honest Look at Your Own Security Culture?

Most leaders don’t realize which of their own habits are quietly setting the tone for the whole team, good or bad. A short outside conversation is often the fastest way to see it clearly.

A short conversation with C Solutions IT can surface where leadership and security culture are working against each other, and what a few visible changes at the top could fix. Call 407-536-8381, get in touch online, or email help@csolutionsit.com to talk it through.

Article FAQs

Why does leadership behavior matter more than security policy?

Employees generally trust actions over stated rules. If leadership consistently models secure habits, most employees follow. If leadership treats security as optional, employees read that as the real policy, regardless of what’s written down.

What is “tone at the top” in a cybersecurity context?

It refers to the standard leadership sets through their own visible actions and decisions, which shapes whether the rest of the organization treats security as a genuine priority or a checkbox exercise.

Does this apply to very small businesses too?

Yes, often more so. In a small business, there’s little distance between the owner’s habits and the rest of the team’s behavior, so leadership and security culture are even more directly connected than in a larger organization.