If research security feels like bureaucracy, we are making the wrong case

A recent study found research security to be widely perceived by researchers as a bureaucratic burden. Sapna Marwaha argues for research security to be relevant to researchers it must connect to the everyday issues they face, rather than be presented as yet another exercise in institutional compliance.

A senior university leader responsible for research security once said that, while they supported it institutionally, it was not relevant to their own biomedical research. The comment captures a central challenge: many researchers still see research security as applying only to particular countries, sensitive technologies or military applications. If they do not recognise their work in those descriptions, they may conclude that it has little to do with them.

Research security requirements exist because genuine risks, legal duties and funder expectations exist. Communication is not the source of those requirements, nor is engagement a substitute for governance. The harder question is whether researchers understand why the requirements are relevant to the decisions they make in their own work.

A 2025 government survey covering 93 UK institutions found that academic staff sometimes perceived research security as irrelevant, bureaucratic or burdensome, while confidence in applying key requirements lagged behind that of professional-services staff. In a sector already under strain, additional assessments, training and approvals can easily be experienced as another demand rather than as support for better research decisions.

A recent University of Manchester study demonstrates this engagement gap. Drawing on a survey of 474 UK STEM academics and 31 interviews, it found that research security practices are present but unevenly embedded, general awareness exceeds detailed understanding, and engagement is still driven more by compliance than by culture.

The usual response is to simplify processes, improve guidance or provide more training. These help, but they do not fully address the harder question: where research security depends on researchers exercising judgement, have we made a persuasive case for why those judgements matter?

Whose reasons are we communicating?

Research security is often explained through the priorities of institutions, governments and funders: policy, legislation, funding conditions, legal penalties, reputational damage or national security. These are legitimate interests, but researchers often remain a sceptical and unengaged audience.

Behaviour is not sustained by awareness alone. Compliance research and UK protective-security guidance both emphasise the importance of showing why a behaviour matters, enabling people to act and aligning security with the organisation’s core work.

Many trusted research teams already do this well. They use case studies, real-world incidents, guidance, briefings and one-to-one advice to raise awareness and support difficult decisions. The point is not that institutions communicate only through rules, but that even good communications can struggle when examples feel extreme or distant from researchers’ everyday choices.

Researchers are not a single audience

In our work with researchers, research managers, funders and policy makers globally, we have seen those points of connection vary. Some researchers respond to moral or public-interest concerns, such as protecting integrity, preventing harm and preserving public trust. Others connect research security to intellectual property, funder conditions, project continuity, reputation or long-standing trusted partnerships.

Effective communication therefore requires more than clarity. It requires putting research security into language different researchers recognise. Awareness is not evenly distributed. Researchers in long-established sensitive disciplines are often alert to export controls, dual-use concerns or security scrutiny. In emerging-risk areas, awareness can be higher but less consistent, as expectations develop faster than shared understanding.

In “lower-risk disciplines”, awareness is often lower because researchers may not recognise that work involving sensitive data, business strategy or confidential information, can also raise research security questions. The Manchester study’s distinction between traditional, emerging and low-risk fields helps explain this inconsistency. This can be particularly true in parts of the social sciences and humanities, where discussions of research security are often perceived as applying primarily to STEM subjects.

As Nicola Searle, Associate Professor at Goldsmiths, University of London, whose research focuses on economic espionage, trade secrets and intellectual property, reflected, she once regarded research security as largely a concern for disciplines working with sensitive technologies rather than her own field. She is now much “less sure”. Questions of confidential information, commercially sensitive insights and knowledge leakage have brought the issue much closer to home. Recent strategic moves to prioritise misinformation and foreign interference and societal resilience, will also increasingly bring disciplines, such as behavioural science, political science, journalism and communications closer into the orbit of research security measures.

Fear can attract attention, but it cannot do all the work

Stories about collaborations that have gone wrong, intellectual contributions that have been misappropriated or research used in unexpected ways can make an abstract issue feel real.

Threat-based messages can attract attention and may support short-term behaviour change, especially where the action is discrete and time-limited. If people repeatedly hear warnings about consequences that feel remote, without understanding what action would reduce the risk or how it connects to their work, the message can lose its force.

Similarly, “because the rules say so” may secure short-term compliance, particularly when completing a process is necessary to unlock funding or gain institutional approval. It is less likely, on its own, to create lasting engagement.

Rules remain necessary, as do proportionate warnings about genuine risks. But neither provides, on its own, a sufficient positive reason for researchers to recognise when a situation needs further thought, exercise judgement and maintain different behaviours over time.

Research security can protect things researchers already value

A more sustainable case for research security starts with the things researchers are already trying to achieve. The Manchester study reaches a similar conclusion, recommending that communication should connect research security more clearly to core academic values: research integrity, safeguarding data and intellectual assets, sustaining responsible collaboration and enabling informed decision-making.

Research security can support ethics, integrity, harm prevention and the protection of sensitive data; protect reputation, trusted partnerships and public confidence; and support continued access to funding. Many funders now include research security terms in funding agreements, and strategic investments such as research centres and doctoral training partnerships increasingly require compliance reporting.

Presented in this way, research security is not an objective competing with good research. It is part of conducting research responsibly and preserving the value that research creates. The engagement challenge is to connect those requirements to recognisable research concerns: what is being shared, who could be affected, what might compromise the work, and whether the situation is unusual enough to justify advice.

This does not remove the tensions. Processes can create burdens and requirements may feel disproportionate, but “the risks are different” is not the same as “this is not relevant to me”. Researchers do not need to become specialists in every aspect of research security, but they do need enough confidence to recognise when additional thought may be required and where to find appropriate support. This also changes how institutions position professional services: less as gatekeepers, and more as sources of advice that help researchers make better-informed decisions.

Making research security meaningful

Frameworks such as the Trusted Research Evaluation Framework already recognise communication, engagement and training as part of mature trusted research practice. As institutional capability develops, the next challenge is to connect research security more clearly to the judgements researchers make in their own work.

When researchers describe research security as bureaucratic, institutions should still examine whether processes are clear, proportionate and necessary. But they also need to connect research security to concerns researchers already recognise: integrity, responsible collaboration, reputation, funding, public trust and protecting the value of their work. For long-term change, we need to both keep explaining why research security matters to institutions, while finding more ways to communicate why it matters to researchers.