Topic starter
25/10/2026 11:09 am
TL;DR: Secure design works best when it makes the secure path the easy path, because every added control spends organisational trust and can drive workarounds, while AI adoption and incident planning both require deliberate choices about which risks to carry, according to Coalition.
Editorial analysis by NHI Mgmt Group, based on content published by Coalition: “Designing Security for the People Who Have to Live With It”.
Key questions
Q: How should security teams balance protection and usability without weakening governance?
A: Start by treating friction as a design cost that must be justified by risk, not as proof of security.
Q: When does a security control create more risk than it reduces?
A: A control becomes counterproductive when it drives users toward unsupported workarounds, exception handling, or shadow processes that are less protected than the original path.
Q: What breaks when organisations assume prevention will always hold?
A: Recovery planning becomes vague, authority stays undefined, and incident response turns improvised when the first real event arrives.
Practitioner guidance
- Define a friction budget for every major control change Assess the user time, exception rate, and operational overhead each new control will consume before approval.
- Review where teams are routing around security controls Map the highest-friction journeys in access, authentication, approvals, and incident workflows, then identify the workarounds people already use to finish their jobs.
- Pre-decide breach authority and containment roles Document who can isolate systems, who communicates externally, and what operational services must remain available if a control fails or a security event escalates.
Bottom line: Security programmes lose effectiveness when controls are so disruptive that users create their own lower-friction workarounds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →