Forgetting Curve

How the forgetting curve affects security behavior

The forgetting curve matters because security controls often depend on people remembering steps accurately after the moment of training. As time passes, recall fades, so password rules, recovery prompts, approval steps, and incident instructions become easier to forget unless they are reinforced in daily use.

This is especially relevant in identity and access workflows, where a forgotten process can become a security weakness. If users cannot remember how to complete recovery, enroll MFA, or verify a suspicious login, they are more likely to bypass controls, reuse habits from other systems, or ask for help in insecure ways.

Why memory-dependent controls fail over time

Controls that rely on memory alone tend to degrade because human recall is not stable under pressure, time, or infrequent use. The longer the gap between training and real use, the more likely it is that a user will make errors, choose the wrong recovery path, or avoid the secure option because it feels unfamiliar.

That makes the forgetting curve a design issue, not just a training issue. If a process only works when users remember a sequence of rare steps, it is fragile by design. Stronger patterns reduce reliance on memory by using prompts, defaults, guided flows, and consistent verification methods.

Where the forgetting curve shows up in identity security

The most visible impact is in password handling, account recovery, and access approval workflows. Users forget complex passwords, mix up recovery answers, or misunderstand when to use a help desk path versus a self-service path, which increases friction and creates opportunities for social engineering.

The same problem appears with rarely used administrative or emergency procedures. If an employee only practices a break-glass or recovery process once a year, they may not remember the exact steps when it matters, and that can slow recovery or lead to unsafe shortcuts.

For that reason, mature programs treat memory-dependent actions as a control weakness and replace them where possible with stronger authentication and clearer workflow design. NIST’s identity guidance on phishing-resistant authentication and assurance levels is one example of how organizations reduce dependence on fragile human recall through better authentication design, while NIST SP 800-53 Rev 5 Security and Privacy Controls provides a broader control baseline for identification, authentication, and account management.

How to reduce the security impact of forgetting

The practical response is to design security so that forgetting is expected, not exceptional. That means using repeated reinforcement, just-in-time prompts, and simpler recovery paths that still preserve assurance. It also means favoring password managers, MFA, and verified self-service over processes that depend on users remembering infrequently used secrets or procedures.

Organizations should also refresh training in small, repeated doses instead of relying on one annual session. When users rehearse a task in the same context where they will later perform it, recall improves and the security process becomes more reliable.

Where a control cannot be simplified, the safer choice is to add guardrails around human memory rather than trusting it directly. That usually means stronger authentication, clearer fallback paths, and monitoring for failed recovery attempts or repeated user confusion.

Related resources from NHI Mgmt Group

• Who is accountable when signature verification is accepted without checking curve parameters and hash requirements?
• What do teams get wrong when they compare security models point by point instead of by curve?
• When does a cost curve become a useful signal during a crypto downturn?
• Catastrophic Forgetting