[Wilya]

It is not an inconsequential oversight. Most people will at least have sessions open to internal/private systems, sometimes sensitive credentials. And part of the teams will go see clients with their company laptops. You absolutely do not want people to be careless about leaving their computers unlocked.

[dividedbyzero]

Hence the "(effectively)" in front of inconsequential. This isn't something that will definitely and automatically result in a lot of damage, it usually won't cause any damage at all (especially if people work on desktop machines in an office that opens to a small number of badges). It may be a vector for a critical breach if enough stars align, and there happens to be an attacker nearby that is motivated, capable and willing to take the risk, and the machine is completely unobserved for long enough, but for most people, that's going to be pretty rare. Setting a short non-overridable screensaver delay is still a good idea, and screen locking should be part of security trainings and all that. It's one possible vector for deep penetration and should be treated accordingly.

But if you're effectively harassing people out of a part of their salary, I'd expect the reason to be something truly overridingly critical, and in all settings where I've seen this sort of rule instituted, it was far from that – and if it were, why would you resort to bottom-up hazing to control that risk? That disincentivizes actually improving security (by giving people another pretext to depend on uncompromised user machines), oversights absolutely will still happen and any damage that actually does occur will be hidden and conceiled even harder, since now you've created an emotional link to public shaming and people respond to that viscerally.

[Cpoll]

> But if you're effectively harassing people out of a part of their salary

Don't you mean (effectively) harassing?