Topic starter
25/06/2026 2:47 pm
TL;DR: Security controls only scale when the secure path is also the usable default, Imprivata says, with passwordless access, MFA, access reviews, and third-party governance depending on workflow design as much as policy. Identity telemetry helps teams spot where friction and workarounds are weakening the control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Five ways to enhance security and usability during Cybersecurity Awareness Month”.
Key questions
Q: Why do passwordless and MFA programmes fail when user experience is poor?
A: They fail because users respond to friction by delaying, sharing, bypassing, or working around controls, which weakens the programme's real coverage.
Q: What are the signs that identity controls are creating too much friction for legitimate users?
A: Common signs include rising application drop-off, longer call centre handle times, more abandoned transactions, and more customers failing at routine authentication steps.
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Practitioner guidance
- Define the identity control plane Map the core access policy layer across logins, devices, applications, and third-party access so the same rules govern each path.
- Reduce friction in high-use workflows Identify the login and access journeys that frontline teams repeat most often, then redesign them so secure access does not slow routine work.
- Extend zero trust to external users Apply the same verification and least-privilege expectations to vendors and contractors that you use for employees, including ongoing monitoring.
Bottom line: Identity control only works at scale when the secure path is also usable enough to become the default path.
Glossary terms: Identity Control Plane, Secure Workflow Parity, Identity Threat Detection and Response
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
25/06/2026 3:56 pm
Identity governance fails when secure workflows are not the easiest workflows: That is the central control-plane lesson in this article. Security policy can be technically correct and still lose operational authority if users are pushed toward workarounds. For IAM and NHI programmes, usability is not a comfort feature, it is part of enforcement.
A question worth separating out:
A: Bring non-employee users into the same access governance model, with least privilege, continuous verification, and monitoring that matches the risk of their access. Third-party users are part of the control plane whether the organisation plans for them or not. Separate governance for external access usually becomes a breach opportunity.
👉 Read our full editorial: Identity as the control plane: balancing security and usability