They fail because users respond to friction by delaying, sharing, bypassing, or working around controls, which weakens the programme's real coverage. Security only improves when the safer path is also the faster or simpler path for routine work. Adoption depends as much on workflow fit as on technical strength.
Why poor user experience breaks passwordless and MFA adoption
Passwordless and MFA programmes often fail at the human workflow layer, not the cryptographic layer. If the sign-in path is slower, more confusing, or less reliable than the old one, users look for the shortest escape route. The control may be sound on paper, but the programme’s effective coverage drops when people delay enrolment, choose weaker fallback methods, or ask colleagues to help them get around it.
The practical test is whether the secure method fits routine work without creating avoidable interruption. When it does not, the user population fragments into compliant users, reluctant users, and bypass behaviours. That is why deployment quality, recovery design, and help desk handling matter as much as the authenticator choice itself.
What friction changes in real-world authentication behaviour
Friction changes behaviour because authentication is repeated constantly, often under time pressure. A small amount of inconvenience can be tolerated once, but repeated prompts, device dependency, enrolment loops, or recovery dead ends make users treat the security control as an obstacle rather than a protection.
In practice, poor user experience encourages patterns that weaken coverage: delayed enrolment, SMS or push fallback dependence, password reuse, shared accounts, excessive help desk resets, and approval fatigue. For a programme built around passkeys or stronger MFA, that can mean the strongest path exists but is not the path most users actually take.
Workflow fit is the core design requirement. Good programmes reduce the number of decisions a user must make at sign-in, minimise recovery uncertainty, and keep routine access faster than legacy alternatives. If ordinary work becomes harder, users will often preserve productivity first and security second.
How to design adoption so the secure path becomes the easiest path
The best programmes remove friction where it is unnecessary and reserve extra checks for genuinely risky actions. A user should not have to understand the architecture to complete sign-in, recover access, or replace a device. That means clear enrolment prompts, predictable recovery, and help desk processes that support the intended control rather than undermining it.
Passkeys and phishing-resistant MFA usually succeed when they are introduced as a default workflow change, not as an optional security add-on. Passwordless and Passkeys Guide is useful here because it connects the user journey with the rollout and recovery design that determines whether adoption holds.
Programme owners should also treat fallback methods as part of the product, not as a temporary exception. If the backup path is easier than the primary path, users will learn to prefer it. If recovery is cumbersome or opaque, support teams will improvise shortcuts that quietly weaken the control.
Risk and Threat Considerations
Poor experience does not just reduce adoption, it creates security exceptions that become durable. Users who are blocked, rushed, or confused are more likely to accept insecure workarounds, and attackers benefit when those workarounds reintroduce password-based access, weak recovery, or overused fallback channels.
Failure mechanism: Friction pushes users toward bypasses, and the programme then loses coverage through weak enrolment, fallback dependence, shared access, or help desk-mediated exception paths.
Impact: The organisation ends up with nominal MFA or passwordless deployment but incomplete protection, larger attack surface, and more recoverable paths for account takeover and social engineering.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Covers phishing-resistant authentication, assurance levels, and user-centered digital identity design. |
| Recommendation — Align enrolment, authentication, and recovery with the assurance level needed for the use case. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Applies because workforce sign-in usability directly affects authentication effectiveness. |
| IA-5 — Authenticator Management | Relevant because poor UX often shows up in credential, token, and recovery handling. | |
| Recommendation — Tune organizational authentication so users can complete daily access without bypassing controls. Manage authenticators and recovery paths so users do not resort to weak fallback behaviour. | ||
| OWASP ASVS | V6 — Authentication | Authentication UX and failure handling materially affect whether users can safely complete sign-in. |
| Recommendation — Verify authentication flows are usable, resilient, and not dependent on insecure workarounds. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and access usability influence whether MFA/passwordless is actually adopted. |
| Recommendation — Standardise account and access workflows to reduce exception-driven bypasses. | ||
Practitioner Guidance
What to prioritise: Start with the highest-volume journeys, sign-in, device change, and account recovery. Those are the places where small usability problems produce the biggest abandonment and workaround rates.
What to verify: Verify that the secure method is faster than the legacy method for routine use, and that recovery does not require a separate, fragile exception process. If users need support just to complete normal access, adoption will drift.
Common mistake: Treating enrolment completion as success. The real measure is sustained use without fallback sprawl, repeated resets, or informal workarounds that reduce the control to a checkbox.
Practitioner takeaway: A strong authentication control only works when the everyday user path is simpler than the insecure alternative, because adoption failure is usually a workflow failure first and a technology failure second.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org