The Hybrid Security Paradox: A Human-Centred Study of How Cyber Risk Perception and Protective Behaviour Diverge Between Home and Office

In the modern workplace, the boundary between the office and the home has dissolved. For most knowledge workers, the question is no longer whether they will work remotely, but how often. This shift has created a new landscape for cybersecurity, a field dedicated to protecting digital information from theft and damage. For decades, security systems were designed with a specific assumption: that employees work in a controlled office environment, using company computers on company networks, under the watchful eye of IT staff. However, as work moves into living rooms and home offices, the tools and training provided by organizations often remain stuck in the past, still tailored for a desk that no longer exists for many. This creates a gap between what people feel is safe and what they are actually protected from. To understand this, researchers look at how people perceive risk—their gut feeling about how likely a cyberattack is—and how that feeling translates into action. If a person feels unsafe, they should logically take more precautions. But human behavior is rarely that simple; sometimes, feeling vulnerable without a clear way to fix it leads to inaction or even avoidance, rather than protection.

A new study by James Carlopio from The University of Queensland investigates this disconnect in the era of hybrid work. The research focuses on a large group of employees across nineteen different Australian organizations, ranging from banks and hospitals to government agencies and non-profits. The study surveyed 588 workers to understand their daily habits, their feelings about safety, and how they interact with security rules. The central question was straightforward: do people feel safer at the office than at home, and does that feeling change how they behave? The findings reveal a surprising paradox. While the majority of employees feel significantly less safe working from home than they do in the office, this heightened sense of danger does not lead them to follow security rules more carefully. In fact, the data suggests the opposite: those who feel the most at risk at home are actually less likely to remember security policies and slightly more likely to reuse passwords across different websites.

The study began by mapping out the reality of the modern workforce. It found that hybrid work is no longer a temporary fix for a crisis but a settled way of life. Among those who reported how much time they spend working from home, nearly all of them do so to some degree. On average, these employees work from home about three days out of a standard five-day week. This is not a small minority of remote workers; it is the majority. Despite this, the support systems in place seem to assume everyone is still in the office. When asked to rate their safety on a scale from one to ten, employees gave their home environment an average score of 7.94, while the office received a higher score of 8.64. More than half of the respondents explicitly stated that they believe a cyberattack is more likely to happen when they are working from home. This fear is well-founded in the reality of the situation; home networks are often less secure, and personal devices are not always managed by the company.

However, the organization's response to this fear appears to be missing the mark. The study found that employees rated the frequency of security discussions with their managers as quite low, averaging just under four out of ten. Training effectiveness was rated as moderate, but there was no evidence that this training was different for home workers compared to office workers. The critical discovery was that feeling unsafe at home did not motivate people to be more careful. Instead, the data showed a negative link: the more unsafe an employee felt at home, the less likely they were to recall the details of their company's security policies. This pattern suggests that when people feel a threat but do not have specific, practical tools or guidance to deal with it, they do not rise to the occasion. Instead, they may retreat or simply ignore the problem, a reaction that happens when the perceived danger is high but the ability to cope with it feels low.

The research also looked at whether the amount of time spent at home changed these feelings. One might assume that the more time someone spends at home, the more unsafe they would feel, creating a steady increase in fear. The study found the opposite. The largest gap in perceived safety between the office and the home was actually found among employees who only occasionally worked from home. Those who worked from home every single day felt a smaller gap in safety than those who switched back and forth. This suggests that people who work from home regularly have adapted to their environment; they have built habits and routines that make them feel more secure, even if the risks are technically the same. The people who are most unsettled are the ones who move between locations irregularly, perhaps because their home setup and the support they receive have not adjusted to their specific needs.

A key part of the study examined whether managers could fix this problem. The researchers tested if frequent communication from a boss about security could calm the fears of those who felt unsafe and help them follow the rules better. The results showed that manager communication did help, but not in the way many might hope. Talking about security made people remember policies better, regardless of how risky they felt. However, this communication did not act as a special shield that stopped the negative effect of feeling unsafe. In other words, having a manager talk about security is helpful, but it does not cancel out the confusion caused by feeling vulnerable at home. The two factors work independently: you need both a manager who talks about security and specific support for the home environment to get the best results. One cannot simply replace the other.

The study also included interviews where employees were asked what the organization could do to better protect them. Without being prompted to talk about home specifically, a significant number of workers brought it up on their own. They mentioned needing better guidance on home Wi-Fi, more reliable virtual private network connections, and training that was tailored to their home environment rather than generic office scenarios. Some even asked for password managers, a tool that helps people use unique passwords for every site without having to remember them all. These spontaneous comments confirmed the statistical findings: employees feel that the current security measures are designed for an office that they no longer occupy full-time. They are asking for a system that fits their actual lives, not a system that assumes they are sitting at a corporate desk.

The implications of these findings are clear for how organizations should approach security in a hybrid world. The traditional approach of telling employees to "be careful" or running annual training sessions based on office scenarios is no longer sufficient. The study suggests that security programs need to be redesigned from the ground up to fit the person and the place where they actually work. This means acknowledging that the home is a distinct environment with its own risks and that occasional remote workers are just as in need of specific support as full-time remote staff. It also means that managers need to have conversations that are specific to the challenges of working from home, rather than repeating office-based rules. The goal is to move from a system that assumes a single, ideal worker to one that supports the diverse reality of the modern workforce.

Ultimately, this research highlights that cybersecurity is not just a technical problem of firewalls and software updates; it is a human problem of design and communication. When employees feel exposed but are given tools that do not fit their reality, they do not become more vigilant. They become less engaged. The path forward lies in recognizing that the way people work has changed permanently and that the systems designed to protect them must change with it. By aligning security support with the actual experiences of employees, organizations can close the gap between feeling safe and being safe, ensuring that protection travels with the worker, whether they are in a corporate office or a living room.