What do security teams get wrong about shopfloor MFA and access control?

Why This Matters for Security Teams

Security teams often treat shopfloor authentication as a simplified version of office IAM, then wonder why users bypass it. The problem is not just convenience. Production environments mix shared terminals, shift handovers, intermittent connectivity and time-sensitive tasks, so a control that slows a line or locks out a technician will be worked around. Current guidance suggests the right model is not “stronger passwords”, but controls that preserve traceability without killing throughput, which is why OWASP Non-Human Identity Top 10 is useful here even when the asset is a machine account or workstation credential rather than a person. This matters because shopfloor access is rarely isolated. Badge taps, shared kiosks, local admin accounts, service accounts and device tokens often sit in the same workflow, and one weak link can become the path of least resistance. The operational risk is not theoretical: NHIs already outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs, which is why identity sprawl and access drift are so hard to control on production networks. In practice, many security teams encounter misuse only after operators have already created local accounts or shared credentials to keep the line moving.

How It Works in Practice

A workable shopfloor model starts with the real job to be done, not a generic login pattern. If an operator needs to start a machine, approve a maintenance step, or retrieve a quality record, the access method should fit that action and expire when the task ends. That usually means combining badge or device-based sign-in, role-based access control for baseline entitlements, and just-in-time elevation for exceptions. The point is to reduce standing privilege while keeping the workflow usable. In practice, security teams should separate interactive access from machine and service access. Human users may authenticate with a badge plus PIN or biometrics at a shared kiosk, while back-end systems use workload identity, short-lived tokens, or certificate-based trust. For the secret-handling side, Ultimate Guide to NHIs — Key Challenges and Risks highlights how often secrets sprawl outside controlled vaults, and that issue becomes worse when shopfloor scripts, scanners and integration agents all need access to the same systems. Pair that with standards such as PCI DSS v4.0 for strong authentication and logging expectations, even if the environment is not a card-processing system, because the operational discipline transfers well. A practical control stack usually includes:

• Shared-device sign-in with fast re-authentication instead of full password entry every time.
• JIT elevation for maintenance, override and supervisor actions.
• Per-shift session logging tied to person, device and task.
• Removal of local admin rights and hardcoded credentials on kiosks, HMIs and edge systems.

The most common failure is assuming the same control can serve operators, engineers and automation without redesign; these controls tend to break down when shift work, offline devices and legacy HMIs force users into cached logins or local accounts because the identity service is too slow or unavailable.

Common Variations and Edge Cases

Tighter access control often increases friction, training burden and recovery complexity, so organisations have to balance traceability against line speed and safety. There is no universal standard for this yet, especially where safety systems and production controls overlap, so the right answer is usually a layered one rather than a single MFA rule. Offline or intermittently connected sites are the hardest case. If a plant cannot reliably reach central identity services, then strict MFA prompts on every task may be unrealistic, and guidance is evolving toward risk-based session reuse, device-bound trust and tightly scoped offline credentials. Shared terminals are another edge case: a PIN on its own is weak, but a full biometric every minute can be unworkable. Best practice is to make the session identity explicit, refresh it at natural handoff points, and keep audit trails that survive operator swaps. The same applies to contractors and temporary labour. A contractor account should not look like a permanent employee profile, and it should not inherit broad plant-wide access just because the visitor badge is active. The 52 NHI Breaches Analysis shows how frequently weak identity hygiene becomes an incident multiplier, and that pattern maps directly to shared floor devices and forgotten accounts. When governance is weak, the shopfloor tends to default to whichever credential gets the job done fastest.

Related resources from NHI Mgmt Group

• What do security teams get wrong about MFA for non-human identities?
• What do security teams get wrong about enterprise auth readiness?
• What do security teams get wrong about JWT headers?
• What do security teams get wrong about passkeys and device loss?