Cybersecurity Awareness Month often asks employees to make safer choices. A harder question is whether identity and access controls make those choices workable. When signing in repeatedly interrupts a real task, people improvise. That behavior can weaken security, but it is also useful evidence about how a control performs outside the policy document.
Dark Reading reports that 95% of surveyed organizations observed frontline authentication workarounds, including credential sharing and staying logged in. Its report, sponsored by Imprivata, points to risks for accountability and policy enforcement. For a security & compliance analyst, the useful response is neither to excuse every shortcut nor to treat every worker as the problem. Find the friction, understand the workaround, and test a safer way to do the job.
Security & compliance analyst: investigate the friction
A workaround tells you two things: an approved process is being bypassed, and someone has found a way to complete work despite that process. Those are both worth understanding. If teams focus only on the rule violation, they can miss a repeated design flaw; if they focus only on convenience, they can lose the identity assurance the rule was meant to provide.
The FIDO Alliance’s summary of research conducted with Imprivata describes authentication interruptions among frontline workers. Organizations estimated that more than a third of frontline workers encounter authentication issues in a typical month. Affected workers lose around 2.5 hours monthly, and surveyed organizations estimated an average annual loss of 32,400 working hours. Reported friction included lockouts, password resets, repeated MFA prompts, switching between users and devices, connectivity failures, and logging in while wearing protective equipment. The summary does not point to one universal cause.
These are survey findings, not a forecast for every workplace. But the range of problems makes one point clear: a single policy change is unlikely to resolve every kind of friction. Look at the work itself and locate the step where the approved route becomes hard to follow.
How workarounds weaken identity and access controls
Credential sharing makes it harder to link an action to an individual. An audit trail may record that an account did something without establishing which person was behind it. That weakens accountability and can complicate a later investigation or review.
An unattended, still-open session creates a different attribution gap. The account may belong to the person who signed in, while another person is now using the workstation. In that case, the record can be associated with a valid identity and still fail to identify the person who performed the action. The issue is not simply whether the account was authorized; it is whether the account continues to represent the person at the keyboard.
Recovery paths matter, too. The FIDO Alliance summary says six in ten surveyed decision-makers cited confirmed or suspected attempts to misuse account resets and socially engineer service desks. That result does not mean every reset request is suspect. It does mean account recovery belongs in an authentication review. Legitimate users need a usable route back into their accounts, and support staff need a consistent way to verify who is asking.
Strong controls on paper do not guarantee secure behavior in practice. Nor is the answer to make every sign-in effortless regardless of risk. The job is to remove avoidable obstacles while preserving appropriate verification and a credible connection between people and their actions.
What frontline workflows reveal
The Dark Reading report uses healthcare as an example. Clinicians may move among patients, shared workstations, and applications during a shift. It reports that 40% of surveyed healthcare organizations said authentication difficulties delay patient care or other frontline work. In a time-pressured setting, remaining signed in or sharing credentials can appear to be the quickest path, even though those shortcuts undermine individual attribution and access policy.
Other environments may face different triggers. The FIDO Alliance summary lists issues ranging from connectivity and device changes to lockouts and repeated prompts. A password rule will not fix a network failure; another awareness message will not speed up a clumsy user-switching process. Diagnosis has to start with the observed point of failure, not the control teams assume is causing it.
A practical review for security teams
Map the workflow. Follow the sequence of tasks, applications, devices, and handoffs where workarounds occur. Ask what happens during shift changes, interruptions, and moves between shared equipment. Support requests and access records can help identify patterns, but neither tells the whole story on its own.
Ask what the shortcut makes possible. Use concrete, non-punitive questions: Which step takes longest? When do people leave a session open? What fails when someone moves to another device or is wearing protective equipment? Understanding the reason does not make a risky practice acceptable. It helps identify a safer alternative that workers can actually use.
Check identity attribution. Review whether individual accounts are practical in the setting and whether session handling matches the way work is done. If staff cannot move between users without sharing credentials, the approved process may be incomplete. The goal is to make activity records meaningfully attributable to individuals, not merely to produce a log entry under some account.
Examine sign-in and recovery together. Review repeated prompts, lockouts, resets, account unlocks, and help-desk verification. The FIDO Alliance’s reported concerns about reset misuse reinforce why recovery deserves the same attention as routine sign-in. Keep a clear path for legitimate users while ensuring exceptional cases do not become informal bypasses.
Match verification to risk. NIST’s multi-factor authentication guidance describes how requiring multiple factors can reduce the risk of an attacker using a stolen password alone. Methods differ, and teams should choose based on the access and risk involved. Consider where stronger verification is warranted and where interruptions add little value. Do not simply weaken a control because it is inconvenient; test whether another supported approach can maintain protection with less disruption.
Measure the outcome. Track authentication-related support requests, lockouts, repeated prompts, recovery events, and reported delays. Compare those measures before and after a change, and examine whether workarounds and attribution gaps have changed as well. Fewer support tickets alone do not prove that access is safer. Usability and assurance need to be considered together.
Keep awareness connected to control design
Training can explain why individual accounts and MFA matter. It cannot make a frustrating process fit the work. Give employees a safe way to report recurring friction, investigate the reports, and tell people what changed. That creates a practical feedback loop instead of a cycle of warnings followed by the same workaround.
For organizations using Microsoft 365 or other enterprise platforms, review sign-in and account-recovery processes in the workflows where friction occurs. Use support requests, access records, and discussions with affected workers to identify recurring problems. Before changing a control, assess how the change could affect verification and individual attribution; then test the revised process in the relevant work setting. Recheck for workarounds afterward, since a process that appears workable in policy may still fail at a shared workstation or during a busy handoff.
The aim is not to remove every prompt. It is to make the approved route dependable, proportionate, and possible to use under real conditions. Dark Reading’s and the FIDO Alliance’s survey findings describe authentication friction and workarounds across surveyed organizations; they do not establish that every workplace has the same causes or needs the same remedy. For security teams, the practical conclusion is to investigate local evidence, address the specific obstacles workers encounter, and verify that changes preserve appropriate authentication and individual accountability.
Sources
- Dark Reading, “What Authentication Workarounds Reveal to CISOs” (sponsored by Imprivata).
- FIDO Alliance, “Frontline Friction: The State of Authentication for Frontline Workers”.
- NIST, Multi-Factor Authentication guidance.
