How to handle executives who prioritize convenience over security
Executives frequently demand lax standards, like disabling device screen locks for productivity, holding full admin access, or uploading sensitive HR databases to AI tools for fancy dashboards. This blatant disregard for risk forces IT professionals into a constant battle of pushing back against mandated practices just to maintain basic data protection.
What the numbers show
Counted from the threads quoted below. How we count
- The most recent one is from November 2026.
- This comes up 153.5× more often in r/ITManagers than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
How to handle executives who prioritize convenience over security
- 1Getting the explicit demand in writing to cover your own liabilities (CYA).Did this help you?
- 2Complying with the request while immediately searching for a new job before the consequences hit.Did this help you?
- 3Using European privacy regulations or Works Councils to legally block the request.Did this help you?
- 4Attempting to negotiate a structured pilot program instead of full access.Did this help you?
- 5Requiring the executive to sign a formal risk acceptance or exemption form.Did this help you?
- 6Documenting the exemptions in a risk register for board members or ISO9001 auditors to review.Did this help you?
- 7Blaming external forces like cybersecurity insurance rates, compliance requirements, or the legal team.Did this help you?
- 8Calculating the exact seconds lost to security measures to prove the productivity argument is false.Did this help you?
- 9Updating resumes and finding a new job before a breach happens.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“My C-Suite staff have finally discovered AI agents, and no matter how much I advise risks, they just continue to push it further.”source ↗
“There is a clear disregard for any information/data security, and who am I to tell the CEO not to upload our entire HR database to Grok so he can have a fancy dashboard?”source ↗
“I have been able to successfully hold back the hordes in favor of a more measured approach and structured pilot. But it's hard, because we can ALL see the potential.”source ↗
“He demanded that his company issued mobile phone and laptop do not auto lock because it affects his productivity. While i extended the screen lock time on the phone I contested doing so on the laptop and explained the risk and the best practice.”source ↗
“How do you approach managing interactions or decisions with executives who consider convenience over security?”source ↗
“The amount of dumb shit I’ve seen due to mandated lax security standards is giving me a panic attack just thinking about it.”source ↗
“I had a know-nothing tell me the CEO of a company should have all admin access to their systems. He didn't see the problem with it.”source ↗
“I had this happen working for a financial institution years ago. Our new "Chief Credit Officer" had come in with huge ass cheeks right on his shoulders. He pulled all kinds of antics. One was buying a cool app that had customer data in it.”source ↗
Where this came up
People with this problem also raised
- 2Why is rushed custom software so insecure?
- 17How to use AI for accounting without breaking client confidentiality
- 5Why does IT have to pull security camera footage for everyone?
- 7Do mandatory passkeys bypass traditional two-factor authentication?
- 2How to secure sensitive form data in databases
- 16How to clean up a hacked website and fix malware