Topic starter
25/06/2026 12:12 am
TL;DR: Ransomware attacks on U.S. critical infrastructure climbed 9% in 2024, while healthcare workers lose 13 minutes per shift to login friction and 47% of organisations reported a third-party breach last year, according to the FBI, Imprivata, and Ponemon Institute. Access design is now an operational security control, not just a usability concern.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “The Impact of Inefficient Access for Critical Industries and Frontline Workers”.
By the numbers:
- Ransomware attacks on U.S. critical infrastructure climbed 9% in 2024.
- In healthcare alone, clinicians lose an average of 13 minutes per shift just logging in.
- 47% of organizations experienced a third-party breach last year.
Key questions
Q: What breaks when frontline access controls are designed for office users instead of shift workers?
A: When access controls assume a private laptop, a single user and long uninterrupted sessions, frontline teams compensate with shared logins, session reuse and manual workarounds.
Q: Why do over-privileged vendor accounts increase breach risk in critical industries?
A: Over-privileged vendor accounts expand the number of systems an outsider can touch and make revocation harder to govern.
Q: How do security teams know if identity friction is becoming a risk?
A: They should watch login duration, failed authentication, device utilisation, and the volume of manual exceptions.
Practitioner guidance
- Reduce frontline login friction Replace repeated password entry with methods that fit shared workstations, shift handoffs and mobile use so users do not revert to insecure shortcuts.
- Re-baseline vendor entitlement Review third-party access against current business need, remove standing access that no longer maps to an active support task and require explicit revocation.
- Design for shared-device reality Account for clinicians, operators and responders who move between stations, devices and locations so the authentication flow does not depend on a private endpoint.
Bottom line: Inefficient access in critical industries is not just inconvenient. It creates the conditions for shared credentials, open sessions and broader exposure to ransomware and third-party compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:03 am
Access friction is now a security control failure, not a user experience nuisance. In critical industries, every extra step in the login flow increases the odds of unsafe workarounds such as shared credentials or unattended sessions. That means the identity control plane is being shaped by operational pressure as much as by policy, and the result is a larger attack surface. Practitioners should treat authentication design as part of frontline risk management, not as a separate usability debate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations prioritise passwordless or privileged access modernisation first?
A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.
👉 Read our full editorial: Inefficient access in critical industries expands both risk and friction