Topic starter
25/06/2026 12:12 am
TL;DR: Login friction, shared credentials and over-privileged vendor access are the pressures Imprivata says are driving risk in critical industries. Frontline workflows suffer when access design forces workarounds that widen exposure and slow shifts.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “The Impact of Inefficient Access for Critical Industries and Frontline Workers”.
By the numbers:
- Ransomware attacks on U.S. critical infrastructure climbed 9% in 2024.
- In healthcare alone, clinicians lose an average of 13 minutes per shift just logging in.
- 47% of organizations experienced a third-party breach last year.
Key questions
Q: Why do over-privileged vendor accounts increase breach risk in critical industries?
A: Over-privileged vendor accounts expand the number of systems an outsider can touch and make revocation harder to govern.
Q: How do security teams know if identity friction is becoming a risk?
A: They should watch login duration, failed authentication, device utilisation, and the volume of manual exceptions.
Q: What breaks when frontline access controls are designed for office users instead of shift workers?
A: When access controls assume a private laptop, a single user and long uninterrupted sessions, frontline teams compensate with shared logins, session reuse and manual workarounds.
Practitioner guidance
- Reduce frontline login friction Replace repeated password entry with methods that fit shared workstations, shift handoffs and mobile use so users do not revert to insecure shortcuts.
- Re-baseline vendor entitlement Review third-party access against current business need, remove standing access that no longer maps to an active support task and require explicit revocation.
- Design for shared-device reality Account for clinicians, operators and responders who move between stations, devices and locations so the authentication flow does not depend on a private endpoint.
Bottom line: Inefficient access in critical industries is not just inconvenient. It creates the conditions for shared credentials, open sessions and broader exposure to ransomware and third-party compromise.
Glossary terms: Frontline Identity, Access Friction, Third-Party Access, Passwordless Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 9:03 am
Access friction is now a security control failure, not a user experience nuisance. In critical industries, every extra step in the login flow increases the odds of unsafe workarounds such as shared credentials or unattended sessions. That means the identity control plane is being shaped by operational pressure as much as by policy, and the result is a larger attack surface. Practitioners should treat authentication design as part of frontline risk management, not as a separate usability debate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations prioritise passwordless or privileged access modernisation first?
A: Most organisations should modernise privileged access controls first or in parallel, because the highest risk usually sits in service accounts, root access and shared administrative paths. Passwordless can improve user experience, but it does not address over-privilege, shared credentials or poor auditability on its own.
👉 Read our full editorial: Inefficient access in critical industries expands both risk and friction