Hard-to-use controls push people toward workarounds, shadow IT, and weak credential habits. When users face repeated login friction or slow access, they are more likely to reuse passwords, skip setup steps, or use personal tools outside IT control. That behavior expands the attack surface and weakens governance, even when the original control was intended to improve security.
Why friction turns security into workarounds
Security controls fail when they optimize for formal restriction but ignore how people actually complete work. If access takes too long, changes too often, or blocks routine tasks, users look for the fastest path forward. That usually means reusing credentials, storing secrets in unsafe places, asking colleagues to share access, or bypassing approved tooling.
The problem is not that users dislike security in principle. It is that repeated friction makes the control compete with productivity, and productivity usually wins. Once a workaround becomes normal, the organisation inherits weaker traceability, weaker segregation of duties, and less confidence that the control is being followed consistently.
Well-designed controls reduce risk because they are usable enough to be followed under pressure. The practical test is whether the secure path is the easiest reasonable path for the task being performed, not whether the control looks strong in a policy document.
How poor usability expands the attack surface
When controls are cumbersome, people create side channels around them. That can mean password reuse, shared accounts, personal cloud storage, consumer messaging apps, or unsanctioned automation. Each workaround increases the number of places where sensitive access and data now exist outside normal oversight.
Those behaviours also weaken detection. If users avoid official processes, security teams lose logs, context, and reliable ownership. Incident response becomes harder because it is no longer clear which account, device, application, or approval path actually performed the action.
Hard-to-use controls also invite selective compliance. Users may complete the easy parts of a process and skip the parts that feel slow or repetitive, such as enrollment, re-authentication, approvals, or secret rotation. That produces a false sense of coverage: the control exists, but the environment around it is increasingly unmanaged.
Why governance weakens even when the control is “strong”
A control can be technically sound and still increase risk if it depends on perfect user behavior. The more a process relies on memory, patience, or manual discipline, the more likely exceptions will accumulate. Over time, those exceptions become the real operating model, especially in high-pressure teams.
This is why security teams should judge controls by observed adoption, not only by intended design. A strong control that many people bypass is weaker than a simpler control that is consistently used. Governance fails when the organisation treats documented policy as proof of actual control performance.
Usability matters most where access is frequent, time-sensitive, or shared across many teams. In those settings, friction does not just slow work, it changes behavior at scale. The result is more shadow IT, more credential sprawl, and more opportunities for accidental exposure or deliberate abuse.
Risk and Threat Considerations
Friction creates a predictable security failure mode: users route around controls that delay work, and those informal paths are often less monitored and less recoverable. That exposes credentials, weakens accountability, and gives attackers more opportunities to exploit the least governed path rather than the intended one.
Failure mechanism: Repeated login prompts, slow approvals, or awkward setup steps push users toward password reuse, shared access, personal tools, and skipped enrollment, which removes the control’s intended security benefit.
Impact: The organisation gets more attack surface, weaker auditability, more account compromise risk, and a larger gap between policy and reality, especially where access is high volume or business critical.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | User friction and workarounds directly affect account control hygiene and access governance. |
| Recommendation — Reduce bypasses by simplifying account workflows and enforcing consistent account ownership. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential reuse, skipping setup, and weak credential habits are authenticator lifecycle failures. |
| AC-6 — Least Privilege | Workarounds often bypass intended privilege limits and expand practical access beyond need. | |
| Recommendation — Manage authenticator issuance, rotation, and storage so users do not need unsafe workarounds. Limit standing access so routine work does not depend on shared or excessive privileges. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | The topic concerns access control effectiveness and how poor usability weakens real enforcement. |
| Recommendation — Design access controls that are usable enough to be followed consistently in day-to-day operations. | ||
| OWASP Non-Human Identity Top 10 | NHI-07 — Long-Lived Secrets | Unsafe credential habits often include keeping secrets in ways that avoid frequent friction. |
| Recommendation — Shorten secret lifetime so users are less tempted to store or reuse credentials informally. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity and Access Management | Access controls must be usable and enforceable for people to follow them instead of bypassing them. |
| Recommendation — Align access workflows with business tasks so approved paths remain the easiest paths. | ||
Practitioner Guidance
What to prioritise: Fix the highest-friction controls first where failure would create the biggest blast radius, such as core access, privileged workflows, and recurring authentication. The goal is not to make every control effortless, but to remove the friction that predictably drives unsafe workarounds.
What to verify: Check whether users can complete the secure path without help desk intervention, shadow tooling, or repeated exceptions. If adoption depends on informal shortcuts, the control is already underperforming and should be redesigned rather than simply enforced harder.
Common mistake: Treating user resistance as a training problem when the real issue is control design. If a control is routinely bypassed, better messaging will not fix the underlying mismatch between the workflow and the security requirement.
Practitioner takeaway: Security improves when the secure path fits the work, because controls that are difficult to use are often the ones most likely to be bypassed, diluted, or quietly abandoned.
Related resources from NHI Mgmt Group
- Why do overly strict DLP controls often increase security risk instead of reducing it?
- Why do traditional CI/CD security scanners often increase developer friction instead of reducing risk?
- Why do unsanctioned SaaS controls often increase risk instead of reducing it?
- Why can prompting users too often for MFA increase security risk instead of reducing it?
