Gwen Betts
//
November 12, 2025
The Big Idea
- Security policies are more important than ever. They need to address a rapidly expanding IT ecosystem and threat landscape, and AI-generated policies make this much simpler.
- The enforcement gap remains a huge problem. Security policies are still difficult to enforce, and current enforcement solutions are incomplete, ineffective, or irrelevant.
- Behavior change starts with observation. Most apps and data are handled through the browser, making it the most logical and impactful place to position an enforcement layer.
- Right-time prevention is your missing safeguard. Maroʼs cognitive security agents reduce the cognitive load of security to zero by protecting behavior in the flow of work.
Security policies are having a moment!
As new technology and data spread across organizations, security policies are constantly being updated and expanded to meet the needs of emerging innovation. The surge in AI governance initiatives is just one example of that. Policies are also adapting in response to a continual barrage of new, novel, and aggressive cyber attacks that yesterday's guidelines don't immediately address.
Fortunately, creating security policies has never been easier thanks to generative AI tools that can spin up comprehensive guidelines with just a bit of expertise and a few prompts. (We even built an easy to use tool for it! Check out MakePolicy.ai)
This is a major step forward to enable security behaviors and to mitigate human risk.
Unfortunately, the most important element is still missing: how to effectively enforce them all in real-time across your workforce. Until this gap is filled, even the very best policies will do very little in terms of protection, and ultimately become a maze for your people to navigate.
Explaining the Enforcement Chasm
Security policies express what's acceptable, what's not, and what best practices look like for handling tools and data safely. They're often a regulatory requirement, and they're essential for defining and implementing an organization-wide cybersecurity strategy. Security policies should also be prescriptive and recommend the right choice.
The challenge: they're not preventative or proactive, meaning they don't stop people from making the wrong choice the moment they're about to act. And with so many to follow, people get lost in a sea of rules but very little practical guidance in the moment.
We call this the policy enforcement chasm.
Security policies get written, people receive training, but then the documents go into storage somewhere and sit idle until the next update. People rarely (if ever) reference policy docs when they encounter uncertainty, meaning that everything from best practices to compliance mandates gets violated.
Security policies rarely promote the good behavior they're intended to for a few reasons:
- Training isn't enforcement: Training makes people aware of security policies but doesn't proactively guide them to adherence. It does little to affect behavior change because people must recall the policies from memory while attacks prey on their reflexes.
- Documents aren't action: Many people struggle to apply policy prescriptions to their actual workflows, and enforcement measures like access controls and DLP don't reach to where most decisions are made.
- Control isn't cognition: Tracking policy violations doesn't reveal intent and context, making it harder to assess risk, improve policies, and teach people where and why their behavior wasn't just a violation but also a real danger.
- Compliance isn't culture: Creating policies, delivering trainings, and tracking KPIs are all great for staying compliant, but they're not the same as creating a security culture where people feel committed to security and confident they're doing it right.
Some recent research shows the enforcement chasm in action. A survey of knowledge workers showed that 73% use generative AI tools at the office, yet 37% don't consistently follow AI policies. So while policies are in place, they are little more than pieces of paper without a way to enforce the rules.
Employees encouraged to use
AI for some part of their workloads
Employees that admit they don't always
follow their company's AI policies
Findings from 1Password, The Access-Trust Gap Annual Report (2025)
The Current State of Policy Enforcement
The security policy enforcement gap isn't a new concept, but it remains an acute problem. How to bring policies to life and enforce them everywhere has been a struggle for years.
You might say, "Hey! We do have security mechanisms in place that enforce specific security policies." And yes, there are many tools that act as technical control points at different network layers for defense-in-depth. However, there remains a notable disconnect between secure intention as security leaders define in policies and actual secure usage of technology.
To bridge this chasm, you need to be able to observe and classify people's usage intention across apps and workloads. Then you have to compare that behavior against security policies; what's approved versus not down to the use case and behavior control. Finally, you flag any misguided actions that create policy violations (oh, and without killing productivity).
The Cognitive Security Loop, Maro (2025)
Must Read: The Behavioral Policy Loop, Explained
Learn how to shift security policy from a static artifact to a dynamic tool for real behavior change.
Doing so takes an ongoing effort. And while various security tools can help, they all have limitations and blindspots in this workflow:
- Identity and access controls are good gatekeepers but miss what happens once someone is on the inside.
- Endpoint and device protections focus primarily on technology-based threat vectors like malware and suspicious processes.
- Email and gateway security filters out threats without teaching secure principles.
- Browser and cloud controls see high-level usage activity but block URLs outright instead of enabling safer alternatives.
- DLP and DSPM solutions extend enforcement to sensitive data handling, but the results are often unreliable.
- Security training and awareness modules get ignored, forgotten, or misunderstood.
Despite having tools to enforce policies at each layer of the tech stack, none works across the entire stack, and each focuses more on technology systems than human behavior.
Incomplete and inconsistent policy enforcement is the result, leaving it largely up to the individual to remember, interpret, and apply policies with no real-time support. Risk thrives in the vast space between written policies and real-time enforcement.
Without a universal companion to help people turn policy into practice, people will continue to be a vulnerable target, and human misuse and error won't improve.
Meet Maro: Your Missing Policy Enforcement Layer
Maro was designed to close the enforcement gap. Built on the principles of cognitive security, in which security controls complement the human mind's natural decision making, Maro turns security policies into a dynamic defense against the worst attacks in the wild.
It starts with a simple browser extension. Once installed, Maro continuously observes for signs of manipulation tactics or technology misuse and course corrects behavior before a policy violation or security risk is about to occur.
Behavior Observability
Maro watches what truly matters: human behavior at the moment of decision. By focusing on people, understanding intent, and comparing usage to approved use cases and behavior guidelines, Maro spots unsecure patterns early and guides people toward safer choices, instantly. Maro knows how security policies best apply to your people's risk exposure.
Adaptive Policies
Even the most thoughtful policies struggle to apply their intent to every person in every situation. Maro understands your people, products, and regulatory pressures and automatically tunes policy protections to your business context. No erroneous setup required. The result: security that moves at the speed and shape of your business.
Right-Time Prevention
Between technology misuse and defending against manipulation techniques, Maro is designed to spot the risks that people miss. It intercepts misaligned behaviors and intervenes so they can't do something unsafe. And all while illustrating why certain behaviors are a security hazard. This focus on prevention in the moment helps to drastically reduce the number of incidents caused by the human element.
Proactive Course-Correction
With Maro as your cognitive security AI companion, you can help your people course-correct in real time. It transforms static policies into active guidance that’s always present, reinforcing secure habits through repetition and feedback. Instead of punishing mistakes, Maro enables people to proceed thoughtfully instead of impulsively and strengthens security culture with every secure action.
Closing the Enforcement Gap is Easier Than You Think
In the absence of enforcement, security policies are just wishful thinking. As Jen always reminds us, “Hope is not a strategy!” Once you fill the enforcement chasm, however, security policies become not just guidelines but powerful guardrails that make misguided decisions, non-compliant activities, and human errors a rarity.
To put it another way: imagine if everyone at your organization could actually follow the security policies. Not only would that have a huge impact on incidents, damages, and disruption, but it would transform your security stack, strategy, and culture. And it would lower the cost, time, and energy spent on cybersecurity.
Enforcement is the key to the whole equation. Maro proves it with a lightweight security companion that has an outsized impact on preventing attacks, protecting behavior, and proactively making employees into a security strength. All it takes is downloading a browser extension to get started. Get in touch for a free assessment.
