Security that people work around isn’t security. It’s theater.
Every security measure creates friction. Passwords, multi-factor authentication, access approvals, VPNs, encryption: each adds steps, slows workflows, and frustrates users. Some friction is necessary. But excessive security friction doesn’t make organizations safer; it makes them less safe, because people find ways around controls that impede their work.
The goal isn’t maximum security. It’s appropriate security: controls proportional to risk that protect what matters without making legitimate work unnecessarily difficult.
The Workaround Problem
When security becomes too burdensome, people adapt, rarely in ways that improve security:
Password stickies. Complex password requirements that change frequently lead to passwords written on monitors or stored in unencrypted files. The policy technically requires strong passwords; the practice produces weak security.
Shared credentials. When individual access is too cumbersome to provision, teams share accounts. Now you’ve lost accountability and audit trails.
Shadow IT. When approved tools require too many approvals or security hoops, people use unapproved alternatives. Corporate data ends up in personal Dropbox accounts and consumer-grade tools.
VPN avoidance. When VPN is required for everything and slows work significantly, people find ways to work without it, or defer work until they’re in the office.
Approval workarounds. When access approval processes take too long, people ask colleagues to do things for them using existing access. The access control exists on paper but not in practice.
These workarounds aren’t malicious. They’re rational responses to friction that impedes legitimate work. But each workaround creates a security gap that didn’t need to exist.
Risk-Proportional Security
Not everything requires the same level of protection. Effective security matches controls to risk:
High-risk, high-friction is appropriate. Production database access, financial system modifications, customer PII: these warrant strong controls even if they create friction. The risk justifies the burden.
Low-risk, high-friction is wasteful. Requiring multi-level approval to access a public marketing document creates friction without meaningful protection. The control is disproportionate to the risk.
High-risk, low-friction is dangerous. Easy access to sensitive systems without appropriate controls creates real exposure. Convenience shouldn’t override protection for genuinely sensitive assets.
Low-risk, low-friction is efficient. Public information, non-sensitive systems, read-only access to general data: these can be easily accessible without meaningful security compromise.
The mistake is applying uniform security regardless of risk. Either everything gets high friction (driving workarounds) or everything gets low friction (creating exposure). Risk-proportional security applies the right controls to the right assets.
Designing for Security and Usability
Security and usability aren’t inherently opposed. Thoughtful design can provide both:
Friction where it matters. Put strong controls on genuinely sensitive operations. Access to customer data, changes to production systems, financial transactions: these warrant authentication, authorization, and audit trails.
Ease where it doesn’t. Don’t protect non-sensitive resources with sensitive-resource controls. Read access to general information, development environments, internal documentation: these can be more accessible without meaningful risk.
Smart authentication. Modern authentication can be both secure and convenient. Single sign-on reduces password fatigue while maintaining security. Biometrics can be faster than passwords. Risk-based authentication applies stronger measures only when behavior is unusual.
Contextual controls. Security posture can adapt to context. Access from a managed device on the corporate network may warrant less friction than access from an unknown device in an unusual location. Context-aware security provides protection without uniform burden.
Streamlined provisioning. When getting legitimate access is easy, people don’t work around the system. Self-service access requests with appropriate approvals, automated provisioning, clear processes: these reduce the friction that drives workarounds.
Sensible defaults. Default to appropriate access for roles rather than requiring explicit requests for everything. Most people in a role need similar access. Start there; handle exceptions as exceptions.
The Security Culture Question
Security controls are only part of the equation. Culture matters too:
Explain the why. People tolerate friction better when they understand its purpose. “This protects customer data” is more compelling than “policy requires it.”
Make reporting easy. When people can easily report security concerns, without fear of blame for mistakes, problems surface faster. Security becomes a shared responsibility rather than a compliance burden.
Respond proportionally. Minor policy violations handled with guidance rather than punishment create different culture than zero-tolerance enforcement. The goal is security, not punishment.
Involve users in design. Security teams that understand how people actually work design better controls. Involve users in security design; they’ll identify friction that seems minor to security teams but major to daily operations.
Finding the Balance
The right balance depends on context. Several factors shape where it falls:
What’s the actual risk? Not theoretical worst-case, but realistic assessment of likelihood and impact. Some organizations over-secure because they haven’t actually evaluated risk.
What’s the user population? Technical users may tolerate complexity that would overwhelm non-technical staff. Controls must be appropriate for the people who encounter them.
What’s the regulatory environment? Some controls are required regardless of usability impact. But within regulatory constraints, there’s often more flexibility than organizations assume.
What’s the current state? If workarounds are rampant, friction is already too high. If incidents are occurring, friction may be too low. Current behavior indicates whether balance is right.
The conversation shouldn’t be “how do we make this more secure?” in isolation. It should be “how do we achieve appropriate security with acceptable friction?” That framing recognizes that excessive friction undermines security rather than enhancing it.
We design systems with security built in: architecture that protects sensitive assets without creating unnecessary friction.
In cloud environments, we implement controls that balance protection with the accessibility the cloud enables.