User-Driven Classification Programs and Why Employees Get It Wrong

Data classification programs ask employees to make a judgment call they were never trained to make, in the middle of doing a job that has nothing to do with security policy. That's the core failure, and it's a design problem. It's a design problem, and it produces the same predictable breakdowns across nearly every organization that runs a human-labeling model: too many labels, shifting context, and drift under pressure. An annual industry breach analysis found that the human element factored into 60% of breaches because human judgment is inconsistent under load. Understanding the mechanics of that inconsistency is the first step toward building a classification model that doesn't depend on it.

What employees are being asked to do when they classify data

Picture the actual sequence. An employee opens a document, reads or skims its contents, decides what that content means to the business, then maps that meaning onto a label from a taxonomy someone else designed, usually months earlier. All of this happens in the seconds before sending an email or saving a file, wedged between the actual task at hand and whatever meeting comes next.

That sequence hides three distinct cognitive jobs, not one. The employee has to recognize what the document contains, judge how sensitive that content is to the organization, and then map that judgment onto whichever label in the taxonomy fits best. Content recognition, business-value judgment, and schema mapping: three separate reasoning tasks, compressed into a single click, performed by someone who was hired to close deals or write code or manage vendors, not to think like a data governance officer.

None of this appears in a performance review. Nobody gets evaluated on classification accuracy the way they get evaluated on a deadline or a sales number. So when a taxonomy asks a user to distinguish "Confidential" from "Restricted" from "Internal Only," the honest answer is that most people are guessing, and the guess is happening under time pressure that has nothing to do with the label itself.

Label overload: when the taxonomy itself produces the wrong answer

Programs tend to start big. Compliance officers want granularity, so a taxonomy grows to eight, ten, sometimes a dozen categories, each meant to capture a slightly different flavor of risk. That level of detail satisfies an audit. It does not survive contact with an employee trying to label a customer proposal at 4:45 on a Friday.

Too many labels is, on its own, a primary failure mode. When categories sit close together in meaning, users can't reliably tell them apart, so they either guess or take the path of least resistance. That path almost always leads to the lowest-friction label, which is usually the least restrictive one available.

That default is rational. It's rational. Over-labeling triggers friction: access requests, encryption prompts, sharing blocks, all the things that slow a person down mid-task. Under-labeling triggers nothing. The system rewards the choice that creates the least immediate resistance, and employees respond to that incentive whether or not anyone designed it on purpose.

ITU Online's 2026 guidance states the underlying principle: governance comes before labels, and if the business meaning is unclear, the technology only automates confusion. A taxonomy built before anyone agrees on what the words actually mean for the business will produce exactly this outcome, every time, regardless of how sophisticated the tooling behind it looks.

Context collapse: the same document carries different risk in different hands at different times

A label is a snapshot. The risk attached to a document is not.

Consider a roadmap deck marked "Internal" on the day it's created. That label doesn't change when the employee who made it accepts an offer from a competitor three months later. The document sits exactly where it was, tagged exactly as it was, while the actual risk around it has shifted. Classification tells you what the data is, but a specific movement of that data, at a specific moment, by a specific person, could be expected or excessive, and the label offers no way to tell.

The pre-departure window makes this failure concrete. Research consistently finds that employees approaching an exit are significantly more likely to take data with them, yet the label sitting on the file does not update to reflect that the employee's status has changed. The document looks the same to the system on the day before resignation as it did a year earlier.

Context collapses in three separate directions, and static labels are blind to all three. Time changes sensitivity: a product gets announced, a merger gets disclosed, and what was sensitive yesterday is public today; or, the reverse happens, a file goes stale and its risk quietly disappears while the label stays put. Sensitivity shifts across recipients too. A file fine for one internal team becomes a different matter entirely in the hands of a contractor, a brand-new hire, or someone in a departure window, and the label carries no information about who's now looking at it. Sensitivity shifts across destinations as well, since the same file moving to a company-managed share drive versus a personal cloud account is not the same event, even though the label attached to the file never changes to reflect where it's going.

Inconsistency under pressure: how cognitive load and time pressure produce classification drift

Research into human error in cybersecurity keeps landing on the same drivers: fatigue, distraction, pressure. Tight deadlines and constant context-switching, stacked notifications competing for attention, all of it raises the odds that a security step gets skipped or fumbled, because attention is a finite resource and classification is rarely the task getting it.

That produces drift. The same employee, classifying the same kind of document, will label it differently depending on whether they're prepping for a meeting, racing a deadline, or wrapping up at the end of a long day. The taxonomy hasn't moved. The person's engagement with it has, and that gap is where inconsistency lives.

Scaled across an organization, this drift becomes statistically predictable and operationally invisible at the same time. A security team looking at a label has no way to see the cognitive state of the person who applied it, no record of whether it was a careful decision or a rushed one made between two meetings.

Programs compound this with what amounts to a one-time mindset. Policies get rolled out, training happens once, and then nobody revisits the taxonomy as the business changes around it. Early adopters, the people who sat through the initial rollout, tend to classify more carefully. Employees who join later inherit a mature, underenforced scheme they were never walked through properly, and the drift accumulates without anyone noticing until it becomes visible somewhere expensive.

What mislabeled and unlabeled data costs

The global average cost of a data breach hit $4.88 million in 2024, a 10% jump from the year before, the largest year-over-year increase since the pandemic. That figure sits at the end of a chain that starts with exactly the kind of classification failure described above: data that was never labeled correctly, or never labeled at all, moving somewhere it shouldn't have.

Insider-related activity carries its own price tag, and it's climbing. Research sponsored by DTEX put the average annual cost of insider-related activity in North America at $24.0 million in 2025, up from $22.2 million the year before. Within that category, negligent insider incidents, the ones most directly tied to classification failure rather than malicious intent, averaged $747,107 in 2024, up from $676,517 the year before that, Ponemon and DTEX found.

IP theft tells a similar story. Data on breach patterns shows a 27% rise in IP theft incidents, and that spike connects directly to the visibility gap classification programs are supposed to close. Intellectual property that was never labeled, or labeled wrong, can't be caught by a DLP policy built to fire only when it sees a label. No label, no trigger, no protection, regardless of how sensitive the file actually is.

Why static labels cannot carry the weight of dynamic risk

A sensitivity label is one person's judgment, frozen at one moment in time. It doesn't update when the file moves, when the person's role changes, or when the broader threat picture shifts around it. Legacy DLP was built for that static world: predictable channels, human-applied tags, rules that fire when a label matches a pattern. It cannot inspect what it was never told to look for, and it cannot reason about whether a labeled action makes sense given everything else happening around it.

Generative AI has turned that gap into something urgent. Legacy DLP has no real concept of an AI prompt as a data-loss vector. Research on breach patterns found that 15% of employees routinely access GenAI systems on corporate devices, and 72% of GenAI access overall runs through non-corporate email accounts, so a meaningful share of data now moves through AI tools in a channel the label-and-block model was never built to see.

Gartner's 2025 Market Guide for Data Loss Prevention projects that by 2027, organizations that build intent detection and real-time remediation into their DLP programs will cut insider risk by roughly a third. That projection is, in effect, an admission about the current model: the static, label-dependent approach is leaving a third of preventable insider risk on the table, and everyone building the next generation of these tools knows it.

What a classification model that accounts for these failures looks like

The fix starts with a shift in what classification even means. Instead of a single judgment made at one point in time by one person, classification needs to become a continuous process, one that keeps asking what the data means, where it's headed, who's touching it, and what pattern of behavior surrounds it.

Content understanding has to stop depending on whether an employee remembered to click the right tag. Systems need to recognize sensitive material by what it actually is, source code, financial projections, a list of acquisition targets, customer records, rather than waiting on a label that may never have been applied correctly, or may never have been applied. A company's most valuable intellectual property frequently carries no label whatsoever because its sensitivity came from business context that a static taxonomy was never built to capture.

Behavioral context has to become a required input, not an afterthought. Knowing that a given employee typically touches finance files only from a managed device, through an approved workflow, gives a system something to compare against. Without that baseline, every action gets judged blindly against a fixed rule, and a legitimate action looks identical to a departure-driven exfiltration attempt.

Destination and account awareness close the loop. The same file landing in a managed repository is not the same event as that file landing in a personal cloud account or an unmanaged AI tool, even though both cases might carry an identical label. Controls need to weigh the data, the destination, who owns the receiving account, and the surrounding pattern of behavior together. A label is a starting point. It was never built to carry the full weight of a decision this dynamic on its own.