Topic starter
25/06/2026 2:47 pm
TL;DR: Organisations can strengthen cyber resilience by making identity the control plane, extending zero trust to third parties, adopting passwordless access, and using access analytics to reduce friction and risk during Cybersecurity Awareness Month, according to Imprivata. The underlying challenge is that security programmes still assume users will tolerate complexity, but control design only works when secure workflows are also the easiest workflows.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Five ways to enhance security and usability during Cybersecurity Awareness Month”.
Key questions
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Q: Why do passwordless and MFA programmes fail when user experience is poor?
A: They fail because users respond to friction by delaying, sharing, bypassing, or working around controls, which weakens the programme's real coverage.
Q: What are the signs that identity controls are creating too much friction for legitimate users?
A: Common signs include rising application drop-off, longer call centre handle times, more abandoned transactions, and more customers failing at routine authentication steps.
Practitioner guidance
- Define the identity control plane Map the core access policy layer across logins, devices, applications, and third-party access so the same rules govern each path.
- Reduce friction in high-use workflows Identify the login and access journeys that frontline teams repeat most often, then redesign them so secure access does not slow routine work.
- Extend zero trust to external users Apply the same verification and least-privilege expectations to vendors and contractors that you use for employees, including ongoing monitoring.
Bottom line: Identity control only works at scale when the secure path is also usable enough to become the default path.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:56 pm
Identity governance fails when secure workflows are not the easiest workflows: That is the central control-plane lesson in this article. Security policy can be technically correct and still lose operational authority if users are pushed toward workarounds. For IAM and NHI programmes, usability is not a comfort feature, it is part of enforcement.
A question worth separating out:
A: Bring non-employee users into the same access governance model, with least privilege, continuous verification, and monitoring that matches the risk of their access. Third-party users are part of the control plane whether the organisation plans for them or not. Separate governance for external access usually becomes a breach opportunity.
👉 Read our full editorial: Identity as the control plane: balancing security and usability