Topic starter
02/09/2026 3:58 pm
TL;DR: Users routinely create insecure workarounds when authentication adds unnecessary friction, according to SecureAuth, and the article argues that customer-first identity design improves security by making safe paths easier to follow. For IAM teams, the real question is whether controls are usable enough to survive real behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “Beyond Tech: A Customer-First Identity & Access Management Approach”.
Key questions
Q: What causes users to bypass secure authentication controls?
A: Users bypass secure authentication when the approved path feels slower, harder, or less reliable than an alternative.
Q: How should security teams reduce IAM friction without weakening control?
A: Start by identifying the access paths that users bypass most often, then redesign those steps so they fit the actual workflow.
Q: What are the warning signs that authentication design is failing?
A: Common warning signs include rising reset volume, repeated help-desk intervention, user complaints about login complexity, and frequent use of unofficial access paths.
Practitioner guidance
- Audit authentication friction points Map every login, step-up, reset, and recovery path that adds delay or confusion, then identify where users are likely to abandon the secure flow or seek shortcuts.
- Make the secure path the easiest path Simplify routine access journeys so the approved method takes fewer steps than informal workarounds, especially for customer-facing identity flows.
- Use adaptive checks for higher-risk events Reserve stronger verification for risky sign-ins, unusual devices, or suspicious behaviour so ordinary access does not carry unnecessary friction.
Bottom line: Authentication controls that feel onerous often produce the very insecure behaviour they are meant to prevent.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 3:58 pm
Customer-first IAM is a control-design issue, not a UX preference. When authentication adds avoidable friction, users do not simply comply less often, they actively search for alternate paths that security teams did not intend. That shifts identity assurance from a policy problem to a behaviour problem, which means the effective control is the one users will actually complete. Practitioners should evaluate controls by adoption, not just by specification.
A question worth separating out:
Q: Should customer identity programmes optimise for usability or control strength?
A: They need both, but usability determines whether the control survives behaviour. A strong control that users avoid is weaker in practice than a slightly lighter control that users complete consistently. The right question is how to preserve assurance while making the secure route the least painful one.
👉 Read our full editorial: Customer-first IAM reduces friction that drives insecure workarounds
This post was modified 2 days ago by NHI Mgmt Group