Angela Sasse
German-British researcher who wrote Users Are Not the Enemy in 1999 and moved the blame for bad password habits from people to systems.
Sasse and Anne Adams at University College London interviewed employees about how they handled passwords. The answer was that they wrote them down, shared them and reused them — not out of carelessness, but because the rules demanded more and harder passwords than human memory can hold. Security departments that treated users as the problem got less security, not more.
Her group later coined the compliance budget: people have a limited appetite for spending effort on security rules, and every pointless rule draws it down. The idea resurfaces in NIST's 2017 guidelines, which stopped recommending periodic password changes. Sasse moved to Ruhr University Bochum in 2018.