Users often see IT security policies as a hindrance. Empathetic policy engineering helps CISOs to promote acceptance and implement security effectively.