Organisations should shift toward authentication methods that combine possession, device, and behavioural signals instead of relying on static secrets alone. That approach can reduce user friction while still improving fraud resistance. The practical goal is to verify the interaction continuously enough to block spoofing, limit account takeover risk, and support passwordless or lower-friction login journeys.
Why Lower-Friction Authentication Usually Means Stronger Controls, Not Fewer
The practical way to reduce password and OTP reliance is to move trust from “something the user knows” to stronger signals that are harder to steal and replay. That usually means passkeys, device-bound authenticators, phishing-resistant MFA, risk-based step-up, and session controls that keep the login path smooth for routine access while tightening scrutiny when context changes.
Static secrets are weak because they are easy to capture, reuse, and automate at scale. A lower-friction design does not remove verification, it changes where verification happens: at enrollment, device binding, token handling, and ongoing session assessment. That is what lets teams reduce login prompts without turning authentication into a blind trust decision.
One useful operating signal is that NHIMG’s Ultimate Guide to NHIs notes that 79% of organisations have experienced secrets leaks, and 77% of those incidents caused tangible damage. That is a good reminder that removing password dependence is not cosmetic, it is often a response to a real exposure pattern.
Where Friction Drops Without Weakening the Authentication Decision
Frustration usually comes from repeated prompts, not from strong authentication itself. Organisations can lower friction by making the strongest step happen once and then preserving trust through the device and session, rather than asking the person to re-enter a secret every time they move between apps or return to a trusted device.
- Use passkeys or other phishing-resistant authenticators where the user experience is device-native and the secret never leaves the authenticator.
- Bind the login to a known device posture, so routine access feels seamless while unfamiliar devices trigger step-up.
- Keep session continuity bounded by risk, not by a fixed timer alone, so low-risk behaviour stays low-friction and anomalous behaviour gets challenged.
- Reduce OTP use for primary login and reserve it for exception handling, recovery, or genuinely high-risk transitions.
For teams trying to translate that into governance, PCI DSS v4.0 guidance from the PCI Security Standards Council is a useful reference point because it explicitly separates access restriction from interactive use by system and application accounts. That reinforces the broader design principle: different access paths need different controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST Zero Trust (SP 800-207), CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secret Sprawl and Credential Exposure | Passwords and OTPs are secrets that should be reduced or controlled to limit reuse and leakage. |
| NHI-03 — Overprivileged Non-Human Identities | Lower-friction access still needs least privilege and bounded access paths after authentication. | |
| Recommendation — Reduce reliance on replayable secrets by moving routine login to stronger, bound authenticators. Scope authenticated sessions tightly so reduced login friction does not expand blast radius. | ||
| NIST SP 800-63 | AAL2 — Authentication Assurance Level 2 | This question is about raising assurance while lowering login burden through stronger authenticators. |
| AAL3 — Authentication Assurance Level 3 | Phishing-resistant authentication is central when replacing passwords and OTPs with stronger methods. | |
| Recommendation — Adopt authenticators that meet the target assurance level without relying on weak shared secrets. Use phishing-resistant authenticators for higher-risk access and sensitive transactions. | ||
| NIST Zero Trust (SP 800-207) | PA-2 — Device Posture and Context | Risk-based, context-aware access reduces prompts while preserving trust decisions. |
| Recommendation — Base step-up decisions on device and context signals instead of re-prompting every login. | ||
| CIS Controls v8 | 6.3 — User Account Management | Lower-friction authentication still depends on disciplined account and access lifecycle handling. |
| 6.8 — Unsuccessful Login Attempts | Reduced password use should be paired with controls that detect guessing and abuse attempts. | |
| Recommendation — Continuously manage account access so new authentication methods do not create stale access paths. Monitor failed authentication patterns to catch abuse once passwords and OTPs are de-emphasized. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication, and Access Control | The topic is fundamentally about improving authentication while reducing user friction. |
| PR.AA-05 — Authenticator Management | Selecting, issuing, and replacing authenticators is central when moving away from passwords and OTPs. | |
| Recommendation — Implement stronger identity and access controls that preserve usability while improving assurance. Manage authenticators so the primary login path can shift away from shared secrets safely. | ||
Practitioner Guidance
What to prioritise: Start by identifying which journeys really need interactive login and which can move to silent or step-up authentication. The biggest friction reduction usually comes from removing unnecessary re-prompts, not from weakening assurance.
What to verify: Make sure the alternative to passwords is actually phishing-resistant and bound to a device or session context. If the replacement still depends on a replayable OTP or an easily transferred secret, you have changed the user flow more than the risk profile.
Common mistake: Teams often keep OTP as the default “safer” option, even though it can still be intercepted or socially engineered. A better pattern is to treat OTP as a fallback, while the primary path uses stronger, less interruptive factors.
Practitioner takeaway: The best low-friction authentication designs reduce how often users are interrupted, not how much assurance the organisation gets; they shift verification to stronger signals and reserve extra prompts for genuinely unusual conditions.
Related resources from NHI Mgmt Group
- How should organisations layer SSO with MFA to reduce login risk without creating unnecessary user friction?
- How should security teams use one-time passwords as part of multi-factor authentication without creating avoidable friction?
- How can organisations reduce fraud without creating excessive user friction?
- How should organisations reduce software licence waste without creating access friction?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
