Cybersecurity as a (helpful) creative constraint

Creativity is usually associated with the idea of freedom. Being free to play with ideas and iterate and try new things – that’s where creativity thrives. 

Except that’s not the whole truth. In tech, having boundaries that you have to work within doesn’t necessarily dampen creativity; actually, we think the right constraints can focus creative thinking and provide the ideal conditions for innovation. 

The reality is that many breakthroughs emerge under pressure. Tight timelines, limited resources, real-world risks. They push us to problem-solve more efficiently and think beyond our normal solutions – and research backs this up. 

In a cross-disciplinary review of creativity under constraints, researchers Oguz A. Acar, Murat Tarakci and Daan van Knippenberg reviewed 145 empirical studies and concluded that individuals, teams, and the organisations they work for all “benefit from a healthy dose of constraints.” They noted that creativity only appears to suffer when constraints are excessive. 

More recently, a meta-analysis of 111 studies examined how constraints relate to creative performance and found a significant positive relationship overall. But that positive relationship was dependent on the type and mix of constraints; so if you want to stimulate original problem-solving, you need to make sure you’re placing the right constraints around it.

Security as a supporter of innovation 

We recently wrote about why cybersecurity is a hidden driver of innovation in tech – and this exploration of boundaries and constraints follows the same train of thought. 

When cybersecurity is seen as a brake on momentum, layering obstacles on top of a team’s work, it isn’t going to support innovation. But if you treat it as part of your creative infrastructure, security policies, threat models, secure design patterns, and even incident drills can all help channel your team’s creativity in useful directions. 

When our colleagues over at Black Hat MEA recently interviewed Sounil Yu (Chief AI Officer at Knostic), they asked him to speak about the value of a cybersecurity framework he developed called the Cyber Defense Matrix. “Its strength is its simplicity,” he said. “It provides scaffolding on which deeper insights could be layered.” 

And beyond that specific framework, this point holds generally: simple, visible structures give innovators room to explore safely.

When the Black Hat MEA team had a conversation with Bernard Assaf (CISO at Airbus) he talked about his work to make space for creativity and innovation within a large-scale organisation: “Striking this balance requires moving from restrictive gatekeeping to an enabling, risk-based framework.” That means building automated guardrails into development so teams move faster and more securely, not slower. 

Finding the balance of constraint and freedom 

The research consistently points to a ‘just right’ level. If constraints are too loose, people drift towards obvious, default ideas. But if they’re too tight, creativity just stalls. The meta-analysis above shows how moderate constraints, especially in combination (for example, blending time and resource limits), often produce more inventive strategies – as long as they don’t overwhelm people.

And design research echoes this. In engineering design, constraints act as both limitation and prerequisite for creativity: they narrow the search space, reduce decision paralysis, and channel teams towards elegant, viable forms.

Why self-imposed constraints can work best 

One important nuance is that how constraints are introduced matters. Experimental work with engineering students (see ‘the ins and outs of constraint’ PDF in this knowledge repository) found that self-imposed constraints were more beneficial to creativity than externally imposed ones – participants showed stronger creative outcomes when they helped set the boundaries.

That makes sense if you think about everyday team dynamics across pretty much any industry; when people feel a sense of ownership over their work, it invites playful exploration. 

Make constraints meaningful – and explain the ‘why’ 

Constraints work best when people understand their purpose (risk reduction, safety, trust). Yu’s original motivation for the Matrix was to cut through noisy, inconsistent language and make decisions clearer. He reflected that “clarity is more valuable than complexity.” 

When you focus on simplicity and purpose, and develop boundaries that work for your team instead of against them, then constraints become a shared discipline instead of a bureaucratic hurdle. 

The notion of creative freedom is a little misleading. Creativity is freedom held in form. So treat cybersecurity as a design partner – giving you the set of meaningful boundaries that turn bright ideas into systems that last.