Notifications
Clear all
Topic starter
25/06/2026 1:13 am
TL;DR: Frontline workers in healthcare, manufacturing, and public safety are being slowed by password rules, repeated MFA prompts, and short session timeouts that disrupt urgent work, according to Imprivata. The broader lesson is that access security fails when it is designed around policy compliance instead of operational reality.
NHIMG editorial — based on content published by Imprivata: frontline access friction and the case for simpler security
Questions worth separating out
Q: How should organisations reduce access friction for frontline workers without weakening security?
A: Start by analysing where identity controls interrupt the work itself, then separate routine authentication from elevated actions.
Q: Why do password and session policies often fail in shift-based environments?
A: They are usually designed around policy consistency, not operational continuity.
Q: What do security teams get wrong about strong authentication in frontline settings?
A: They often assume that more prompts, shorter sessions, and stricter passwords automatically mean better protection.
Practitioner guidance
- Map access friction against critical workflows Measure where logins, MFA prompts, and session expirations interrupt care, production, or dispatch.
- Separate routine access from elevated access Use different assurance paths for normal task execution and privileged actions so frontline staff are not forced through the same reauthentication flow for every activity.
- Tune session timeouts to operational context Align timeout policy with shift length, device type, and the time-critical nature of the work.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of how password policy, MFA, and session timeouts disrupt healthcare, manufacturing, and public safety workflows.
- The article's full discussion of why overly strict access controls can create burnout, workarounds, and compliance gaps.
- The practical framing for making security feel invisible until needed, rather than constantly interruptive.
- The source's own examples of frontline scenarios where access friction slows critical work.
👉 Read Imprivata's perspective on simplifying frontline access security →
Frontline access friction: what it means for IAM teams?
Explore further
25/06/2026 10:29 am
Frontline access friction is a governance failure, not just a usability complaint. The article shows that controls can be technically correct and operationally wrong at the same time. When legitimate users lose time to repeated sign-ins, the programme is signalling that policy has outrun workflow. For identity leaders, the practical conclusion is that access governance must be measured against task completion, not only against policy conformance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who should own the trade-off between security and frontline productivity?
A: IAM, PAM, operations, and business leadership should own it together because the impact is shared. Access policy that slows patient care, production, or response is not only an identity issue, it is an operational resilience issue. The right owner is the programme that can measure both risk and workflow impact.
👉 Read our full editorial: Frontline access friction is becoming a security problem
