How do you know whether an authentication control is too burdensome?

Why This Matters for Security Teams

An authentication control is too burdensome when it pushes people toward bypasses, shared access, or “temporary” exceptions that never get removed. The real risk is not inconvenience alone. Overly heavy authentication can create blind spots that erode assurance, especially when security teams mistake friction for strength. NHI Management Group notes that only 20% of organisations have formal processes for offboarding and revoking API keys, a sign that operational drag often outlasts policy intent in real environments. The same pattern appears in broader identity programs when controls are hard to use and easy to work around, as reflected in the Ultimate Guide to NHIs — Standards and the Twitter Source Code Breach case study. Good controls should reduce risk without creating new incentives to circumvent them. In practice, many security teams discover that an authentication step was “working” only after users had already normalised the bypass.

How It Works in Practice

The practical test is whether the control changes behaviour in the direction you intended, or whether it simply redistributes effort into exceptions, tickets, and manual overrides. A burdensome control usually shows up in one or more of these ways: login success drops, help desk volume rises, approval queues grow, users request standing exceptions, or teams build shadow processes around the control.

Security leaders should evaluate burden at the point of use, not just during design review. Compare the control’s risk reduction against the operational cost it creates. For example, a high-assurance step that protects sensitive actions may be justified if it is rare and well targeted. The same step becomes excessive when applied to every routine task, especially if the workflow is time-sensitive or repeated many times a day. NIST guidance on access control and authentication helps frame this as a balance between assurance and usability, rather than a binary choice, as described in the NIST SP 800-53 Rev 5 Security and Privacy Controls.

• Measure abandonment: where do users stop, delay, or retry the workflow?
• Track exceptions: are “temporary” waivers becoming permanent access paths?
• Review support demand: is the control generating repeat tickets or coaching?
• Inspect workarounds: are users sharing accounts, caching credentials, or moving to unsanctioned tools?
• Validate proportionality: does the control match the sensitivity and frequency of the action?

For NHIs, the same logic applies to service accounts, API keys, and automation pipelines, where friction often causes secrets to be hardcoded, duplicated, or left in place too long. That is why NHI-specific governance and visibility matter, as highlighted by the Ultimate Guide to NHIs — Standards. These controls tend to break down when authentication is applied uniformly to every workflow in a high-volume automation environment because operators start bypassing the process to keep systems running.

Common Variations and Edge Cases

Tighter authentication often increases user effort, so organisations have to balance assurance against task criticality, frequency, and operational tolerance. There is no universal standard for the exact point where a control becomes too burdensome; current guidance suggests treating burden as a measurable risk signal rather than a subjective complaint.

Some controls are expected to feel restrictive. A privileged change request, an emergency admin path, or a step-up prompt for sensitive transactions can be appropriate if the risk is high and the event is infrequent. The burden problem starts when the same control is reused for routine access, especially in environments with shift work, third-party operators, or machine-driven processes. In those settings, even well-intentioned MFA or approval gates can drive unsafe behaviours if they are not paired with workflow design, exception governance, and review of actual usage patterns.

ISO 27001 is useful here as a management lens because it forces organisations to ask whether the control is operating effectively and proportionately, not merely whether it exists on paper, as outlined in ISO/IEC 27001:2022 Information Security Management. For teams managing NHIs, this matters even more because automation does not tolerate slow manual recovery well, and excessive friction often leaks into secrets handling and exception sprawl. The harder the control is to complete, the more likely it is to be replaced by convenience-driven shortcuts.

Related resources from NHI Mgmt Group

• How do you know if an authentication stack is too limited for enterprise customers?
• How do you know whether privileged remote access is actually under control?
• How do you know whether access governance is too dependent on human review?
• How do you know whether SaaS visibility is actually improving control?