Join our Newsletter — 33% off our NHI Course

Forgetting Curve

The forgetting curve is a pattern showing how people lose memory of newly learned information over time when it is not reviewed. In identity security, it helps explain why users forget passwords, recovery answers, and access procedures, which is why memory-dependent controls often need MFA, password managers, and refresher training.

How the forgetting curve affects security behavior

The forgetting curve matters because security controls often depend on people remembering steps accurately after the moment of training. As time passes, recall fades, so password rules, recovery prompts, approval steps, and incident instructions become easier to forget unless they are reinforced in daily use.

This is especially relevant in identity and access workflows, where a forgotten process can become a security weakness. If users cannot remember how to complete recovery, enroll MFA, or verify a suspicious login, they are more likely to bypass controls, reuse habits from other systems, or ask for help in insecure ways.

Why memory-dependent controls fail over time

Controls that rely on memory alone tend to degrade because human recall is not stable under pressure, time, or infrequent use. The longer the gap between training and real use, the more likely it is that a user will make errors, choose the wrong recovery path, or avoid the secure option because it feels unfamiliar.

That makes the forgetting curve a design issue, not just a training issue. If a process only works when users remember a sequence of rare steps, it is fragile by design. Stronger patterns reduce reliance on memory by using prompts, defaults, guided flows, and consistent verification methods.

Where the forgetting curve shows up in identity security

The most visible impact is in password handling, account recovery, and access approval workflows. Users forget complex passwords, mix up recovery answers, or misunderstand when to use a help desk path versus a self-service path, which increases friction and creates opportunities for social engineering.

The same problem appears with rarely used administrative or emergency procedures. If an employee only practices a break-glass or recovery process once a year, they may not remember the exact steps when it matters, and that can slow recovery or lead to unsafe shortcuts.

For that reason, mature programs treat memory-dependent actions as a control weakness and replace them where possible with stronger authentication and clearer workflow design. NIST’s identity guidance on phishing-resistant authentication and assurance levels is one example of how organizations reduce dependence on fragile human recall through better authentication design, while NIST SP 800-53 Rev 5 Security and Privacy Controls provides a broader control baseline for identification, authentication, and account management.

How to reduce the security impact of forgetting

The practical response is to design security so that forgetting is expected, not exceptional. That means using repeated reinforcement, just-in-time prompts, and simpler recovery paths that still preserve assurance. It also means favoring password managers, MFA, and verified self-service over processes that depend on users remembering infrequently used secrets or procedures.

Organizations should also refresh training in small, repeated doses instead of relying on one annual session. When users rehearse a task in the same context where they will later perform it, recall improves and the security process becomes more reliable.

Where a control cannot be simplified, the safer choice is to add guardrails around human memory rather than trusting it directly. That usually means stronger authentication, clearer fallback paths, and monitoring for failed recovery attempts or repeated user confusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 IA-2 — Identification and Authentication (Organizational Users) Identity workflows here depend on users remembering access steps and authenticating reliably.
IA-5 — Authenticator Management Forgetting directly affects passwords, recovery secrets, and other authenticators that must be managed.
AC-7 — Unsuccessful Logon Attempts Memory lapses often surface as repeated login failures and recovery attempts.
Recommendation — Use IA-2 to strengthen user authentication so access does not depend on memory alone. Apply IA-5 to manage authenticators, rotation, and recovery methods that users commonly forget. Use AC-7 to limit repeated failed attempts and trigger safer recovery paths.
NIST SP 800-63 Digital Identity Guidelines The guidance informs stronger authentication and recovery design when users forget credentials or steps.
Recommendation — Align recovery and authenticator choices with NIST 800-63 guidance to reduce dependence on memorized secrets.
CIS Controls v8 CIS-5 — Account Management Forgotten credentials and recovery habits affect how accounts are provisioned, used, and recovered.
Recommendation — Apply CIS-5 to manage account lifecycle and recovery processes that fail when users forget key steps.