Flow Visits are funnel analytics that show how users move through each step of an authentication or onboarding journey. They make it possible to see where users drop off, whether a security control is introducing friction, and whether mitigations are working as intended. The metric is useful for both experimentation and operational monitoring.
Expanded Definition
Flow visits are a way to measure how people move through an authentication or onboarding journey, step by step, so teams can see where completion succeeds, where users abandon the process, and where a control may be creating avoidable friction. In identity and access contexts, the metric is about behaviour across the journey, not just whether the final login or enrollment succeeded.
The term is often used in experimentation, product analytics, and security operations, but the security meaning is narrower than general web analytics. It is most useful when a flow includes a policy decision, such as step-up verification, device checks, passkey enrollment, MFA enrollment, or recovery steps. Definitions vary across vendors, so practitioners should treat “flow visit” as a measurement lens rather than a control in itself.
That distinction matters because a drop-off does not automatically mean a bad control. It may reflect legitimate friction, poor copy, an unreachable step, or a policy that is correctly rejecting risky sessions. For background on how identity controls fit into broader security governance, NIST SP 800-53 Rev. 5 Security and Privacy Controls provides the control language that flow metrics often help validate.
Examples and Use Cases
- A security team tracks where users abandon an MFA enrollment flow after password entry, then compares the result before and after a UX change.
- An identity team monitors onboarding flow visits to see whether device trust checks are causing excessive drop-off for legitimate users.
- An operations group reviews recovery flow visits when help desk volume rises, looking for a failing verification step or a confusing handoff.
- A product owner uses flow visits to compare passkey enrollment completion against other authenticators and identify which step needs refinement.
- A governance team uses the metric to decide whether a mitigation is reducing abuse without making normal enrollment unworkable.
The main trade-off is interpretability. A simple completion rate can hide where people struggle, while flow visits expose the exact break point but require careful reading to separate genuine security friction from ordinary usability issues. In NHI-heavy environments, that distinction becomes more important because machine or service onboarding flows often have no human fallback and a failed step can stall dependent systems.
Security Implications
Flow visits can reveal when a security control is too strict, misconfigured, or poorly integrated with the surrounding journey. If a step repeatedly drops legitimate users, organisations may end up weakening the control, adding bypass paths, or encouraging shadow processes that are harder to govern.
They also expose a different kind of risk: a control can look effective in aggregate while quietly failing at one specific step. That failure may create blind spots in authentication, recovery, or onboarding, especially when the journey includes secrets, device binding, or assurance checks. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, which is a reminder that many identity journeys remain poorly observed once they move beyond human login.
Practitioners should read the metric as a signal of both assurance and friction. A sudden change in the path can indicate a broken integration, a policy change that was not communicated, or an abuse pattern that is forcing extra verification and causing legitimate users to fail.
Domain and Governance Relevance
Flow visits matter in NHI governance because machine identity journeys often have distinct failure modes from human ones. Service accounts, API keys, workload identities, and automated enrollment paths do not tolerate vague remediation or manual exceptions well, so every drop-off can point to a lifecycle problem, a trust problem, or an ownership gap.
In practice, the metric helps connect policy intent to operational reality. If a revocation, rotation, or registration step is causing repeated abandonment, the issue may be more than user experience: it may show that the control is hard to complete, poorly automated, or not aligned to the system that depends on it. For NHI programs, that makes flow visits useful as a governance indicator, not just a product metric.
The term is also relevant wherever security teams need to prove that a safeguard is being adopted without introducing unmanageable friction. That is especially important in environments where identity journeys are part of the control plane for agents, services, and other non-human actors.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | Flow visits measure how authentication and onboarding steps affect access assurance. |
| Recommendation — Use flow metrics to spot where identity assurance steps are breaking legitimate access. | ||
| CIS Controls v8 | 6 — Access Control Management | Flow visits expose friction and failure in access and onboarding control paths. |
| Recommendation — Review flow drop-off to fix access-control steps that block valid users or systems. | ||
| NIST SP 800-63 | 4.1 — Identity Proofing and Enrollment | Enrollment flows are a direct measurement surface for identity proofing and onboarding. |
| Recommendation — Measure enrollment completion to detect proofing or onboarding steps that need redesign. | ||
| NIST Zero Trust (SP 800-207) | AC-3 — Access Enforcement | Flow visits show whether enforced access decisions are usable and effective in practice. |
| Recommendation — Validate that access enforcement blocks risk without creating unnecessary abandonment. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secrets and Credential Management | NHI onboarding and recovery flows often depend on secret and credential handling. |
| Recommendation — Track credential-flow abandonment to find NHI onboarding steps that weaken control adoption. | ||
