Reduce it by making security controls easy to use correctly, so people do not bypass them. Keep authentication steps clear, minimise repeated prompts, give actionable error messages, and align workflows with user tasks. Test controls with real users, especially high-friction steps such as MFA enrolment, password resets and approval flows, then remove features that create predictable workarounds.
Why psychological acceptability fails in practice
Psychological acceptability is lost when a control makes the secure path feel harder than the unsafe shortcut. Users then improvise, reuse passwords, postpone enrolment, ignore warnings, or ask for exceptions. The problem is usually not user attitude alone, but a mismatch between the control design and the real workflow people are trying to complete.
That mismatch shows up most clearly when a control adds friction without giving the user enough context to act correctly. If an approval step is opaque, an MFA prompt appears unexpectedly, or an error message gives no recovery path, people learn to work around the control instead of through it.
Good design makes the intended behaviour the easiest behaviour. That means the user should understand what to do, why the control is appearing, and what happens next, without having to guess or contact support for routine cases.
Which mitigations actually reduce the risk
The most effective mitigation is to remove unnecessary friction from the security path itself. Keep the steps short, make the interface self-explanatory, and align prompts with the task the user is already performing. Where a control must interrupt the user, explain the reason and provide a clear recovery action so the user does not create their own workaround.
Minimise repeated prompts and avoid asking for the same confirmation more often than the risk justifies. Frequent interruption trains users to click through alerts without reading them, which weakens both security and usability. The better pattern is targeted prompting at the point of real risk, not constant challenge for routine activity.
Actionable error messages matter because they turn failure into a recoverable state instead of a dead end. If an MFA enrolment fails, a password reset is rejected, or an approval stalls, the user should see the next valid step, not a generic denial. That reduces support load and lowers the chance that people bypass the control entirely.
Where to focus testing and design review
Test the control with real users before treating it as effective. High-friction moments such as MFA enrolment, password resets, session reauthentication, and approval workflows are where secure design often fails in practice. Observe whether people can complete the task without coaching, guesswork, or repeated help desk intervention.
Review the control against the actual work context, not an idealised one. A design that works in a lab can still fail if it interrupts time-sensitive tasks, mobile workflows, or delegated operations. If users repeatedly develop predictable workarounds, the control is signalling a design problem that needs correction, not a training problem to be absorbed by the workforce.
Remove or redesign features that create routine exceptions. If a security step is so awkward that teams routinely request exemptions, it is usually better to simplify the control, adjust the workflow, or narrow where it applies than to keep an elegant policy that nobody follows.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST SP 800-63 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Psychological acceptability affects whether users can complete authentication correctly. |
| Recommendation — Design authentication flows so users can complete them correctly with minimal confusion and avoidable friction. | ||
| NIST SP 800-63 | Digital Identity Guidelines | This subject is about usable identity proofing and authentication that people can actually complete. |
| Recommendation — Apply identity guideline principles to make enrolment and authentication understandable and recoverable. | ||
| OWASP ASVS | V6 — Authentication | The question concerns making authentication usable enough that users do not bypass it. |
| V7 — Session Management | Repeated prompts and awkward reauthentication are session usability issues that affect acceptance. | |
| Recommendation — Review authentication flows for usability barriers that encourage predictable workarounds. Tune session prompts and reauthentication intervals to reduce needless interruption without weakening security. | ||
Practitioner Guidance
What to verify: Check whether the secure path is still the shortest credible path for the user’s common task. If the control only works when users are careful, it is too fragile to rely on at scale.
Common mistake: Treating user resistance as the main problem. In most cases, resistance is a signal that the control is poorly matched to the task, the timing, or the amount of explanation provided.
What good looks like: Users can complete the intended action on the first attempt, understand why a security step appears, and recover from errors without inventing their own process.
Practitioner takeaway: Reducing risk here is less about persuading users to tolerate friction and more about designing controls that remain usable when people are busy, interrupted, or under pressure.
Related resources from NHI Mgmt Group
- Guide: Secure Coding Guide
- What mitigations reduce the risk of insufficient granularity of access control?
- What mitigations reduce the risk of improper handling of insufficient privileges?
- What mitigations reduce the risk of insufficient entropy?
- What mitigations reduce the risk of insufficient verification of data authenticity?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org