How can organisations prove a tool is reducing friction?

Why This Matters for Security Teams

Proving that a tool reduces friction is not the same as proving that people like it. Security teams need evidence that the tool removes handoffs, shortens cycle time, and reduces the number of places where work can stall or fail. That matters because friction often hides in identity workflows, secret handling, approvals, and cross-system remediation, where a “helpful” tool can still leave operators doing the hard parts manually.

Current guidance suggests evaluating operational outcomes alongside adoption signals. The NIST Cybersecurity Framework 2.0 frames governance, measurement, and continuous improvement as part of security maturity, not an afterthought. For non-human identities, NHIMG’s Ultimate Guide to NHIs shows why this matters: only 5.7% of organisations have full visibility into service accounts, which makes it easy to mistake partial automation for real simplification. In practice, many security teams encounter friction only after users have already built workarounds around a tool that looked efficient on paper.

How It Works in Practice

The most reliable way to prove friction reduction is to compare the same workflow before and after deployment using a stable set of operational metrics. That means measuring onboarding time, resolution time, approval latency, training burden, and the number of manual steps required to complete a task. A useful tool should reduce re-entry, duplicate approvals, and context switching, not simply move those burdens to a different console.

For identity-heavy workflows, the strongest evidence usually comes from event data rather than surveys alone. Teams can instrument ticketing systems, access workflows, secret rotation jobs, and audit logs to show how long a request takes end to end, how often it is bounced between teams, and where humans still intervene. This is especially important in NHI operations, where misconfigured vaults, long-lived credentials, and poor offboarding often create hidden effort. NHIMG’s Ultimate Guide to NHIs notes that 71% of NHIs are not rotated on time and only 20% have formal offboarding and revocation processes, both of which create recurring friction that a good tool should reduce.

Practically, teams should define a baseline, deploy the tool, then compare results across a realistic sample of users and workflows. Useful checks include:

• Did the average onboarding path lose steps, approvals, or waiting time?
• Did ticket volume drop because users no longer need manual exceptions?
• Did training time shrink because the workflow became self-service?
• Did the number of systems touched per task decrease?

Where relevant, align the measurement plan to the NIST Cybersecurity Framework 2.0 so improvement is tied to governance and continuous monitoring, not anecdotal satisfaction. These controls tend to break down when organisations measure only user sentiment or ticket deflection because both can improve while the underlying workflow remains slow and manually stitched together.

Common Variations and Edge Cases

Tighter measurement often increases reporting overhead, requiring organisations to balance speed of delivery against the cost of instrumentation. That tradeoff matters because not every environment can support full telemetry from day one, and some teams must begin with sampled workflows or a small set of high-friction processes.

There is no universal standard for this yet. For internal developer platforms, friction may be best captured by time-to-first-successful-deploy and number of manual approvals. For service-account or API-key management, the better signals are rotation latency, failed automation runs, and the number of emergency exceptions raised by operations. In highly regulated environments, a tool may reduce effort for users but add compliance checks that are necessary, so the correct question is whether the control path is more efficient without weakening assurance.

Best practice is evolving, but the principle is stable: prove reduction with before-and-after operational data, not with adoption alone. If a platform claims to simplify non-human identity work, compare it against the baseline problems identified in the Ultimate Guide to NHIs, especially visibility gaps and overdue rotations, because those are often where friction is most visible and most expensive.

Related resources from NHI Mgmt Group

• How should organisations prove identity governance is reducing risk, not just activity?
• How can organisations tell whether CIAM is actually reducing friction and risk?
• Should organisations prioritise reducing secret reuse over faster scanning?
• How should organisations prove EU AI Act compliance across the AI lifecycle?