Topic starter
11/06/2026 11:59 pm
TL;DR: Security friction can push employees toward weaker habits and shadow IT, while passwordless authentication and Conditional Access let organisations tighten access without making every login a productivity event, according to JumpCloud. The real test is whether security policies fit the workflow well enough that users do not seek easier, unmanaged paths.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “The Security Paradox: Protecting Data Without Driving Users Insane”.
Key questions
Q: How should security teams reduce passwordless friction without weakening control?
A: Security teams should simplify enrolment, recovery, and device replacement so the approved path is the easiest path.
Q: Why do strict security policies sometimes increase shadow IT risk?
A: Strict policies can increase shadow IT risk when they make sanctioned access slower or harder than unsanctioned alternatives.
Q: What are the signs that Conditional Access is not tuned well?
A: Frequent user complaints, repeated help desk requests, and broad MFA prompts on low-risk sessions usually indicate the policy is too blunt.
Practitioner guidance
- Replace password-centric login flows Prioritise passwordless methods for workforce access where device, browser, and identity assurance support it, so the approved path is easier than credential reuse or password resets.
- Tune Conditional Access for context Use device health, network location, and application risk as policy inputs so high-trust sessions stay low-friction while risky sessions step up.
- Measure workaround behaviour Track password reset volume, help desk friction, and unsanctioned app use as indicators that access controls are too cumbersome for normal work.
Bottom line: Password-heavy access models often create the very workarounds they are meant to prevent, especially when users need speed more than policy friction.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 8:56 am
Friction is a control failure when users can predictably work around it. Security programmes that rely on repeated password entry, frequent resets, and blanket MFA create pressure to bypass the intended path. That pressure does not just reduce satisfaction, it changes identity behaviour in ways the policy was never designed to absorb. The practitioner conclusion is that control design has to be evaluated against user behaviour, not policy intent alone.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: How can organisations balance authentication security and usability?
A: Use risk-based controls that raise friction only when the access request warrants it. If every login feels equally hard, users look for shortcuts; if every login is equally easy, assurance drops. Good programmes tune controls to application sensitivity, device context, and session risk.
👉 Read our full editorial: Passwordless access and conditional controls can reduce security friction
This post was modified 4 days ago by NHI Mgmt Group