Over-blocking is a safety failure too

Most security training scores one thing: did people catch the attack? That misses half the problem.

In the threat-response simulation I built for a UK retail client, real attacks sit alongside genuine messages from suppliers and colleagues. It measures both: who stops the attack, and who keeps genuine work moving.

A team that blocks everything looks safe on a dashboard. In practice it slows the business, people work around the controls, and eventually the controls get switched off.

The simulation also asks people how sure they are, without scoring it. The result I watch most is “sure, but unsafe”: confident decisions that are wrong. That is where training should go.

AI safeguards work the same way. A guardrail that refuses legitimate requests teaches people to route around it. Measure misses and false alarms together, and design the moment a system says no as carefully as the moment it helps.