If security is hard, people will work around it

Every IT department has seen the pattern. A new security measure is rolled out. It’s well-intended, it’s documented, and it passes the audit. Then, a few weeks later, people have quietly found a way around it.

The password policy demands a complex password every 90 days, so people use Summer2025!, then Autumn2025!. The VPN is slow, so files get emailed to personal accounts. File sharing is locked down, so a free transfer service gets the job done. Multi-factor authentication asks for approval so often that people tap “Approve” without reading.

None of these people are trying to cause a breach. They’re trying to get their work done. When the secure way is harder than the insecure way, people choose the insecure way. And usually, nobody in IT ever finds out.

Users aren’t the weakest link

“The user is the weakest link” is one of the most repeated phrases in IT security. I think it’s the wrong way to look at it.

People are predictable. They want to finish their task with as little friction as possible. A security design that fights that instinct will lose, every time, no matter how many awareness trainings follow it. The weak link isn’t the user. It’s security that was designed around the user instead of for them.

The good news is that the opposite is also true. When the secure option is also the easiest one, people choose it without being told.

Friction has a cost, even when nobody complains

It’s tempting to measure security by how many controls you have. But every control has a cost for the people living with it:

• Time. Extra sign-ins, approvals and waiting for a slow connection add up across a whole organization, every day.

• Attention. People who are asked to approve things constantly stop paying attention. Attackers know this: flooding users with sign-in prompts until someone approves one is a well-known attack technique.

• Trust. When security mostly feels like an obstacle, people stop seeing it as something that protects them. They start seeing IT as something to get around.

That’s why rigid rules are being dropped by the people who wrote them. The US standards body NIST has for years advised against forcing regular password changes, because the result was predictable, weaker passwords. Microsoft removed password expiration from its own security baseline recommendations for the same reason.

The bloated laptop problem

There’s a second way security forgets the user: by piling software onto their device.

A typical business laptop today can run an antivirus, an EDR agent, a VPN client, a web proxy agent, a data-loss prevention agent, a network access agent, a backup agent and a handful of management tools. Each one was a reasonable decision on its own. Together, they mean slower startups, shorter battery life, fans running in meetings, update storms and conflicts between products.

And every agent is software that runs with deep privileges on every device. When one fails, it fails everywhere at once. In July 2024, a single faulty update to a widely used endpoint security agent crashed millions of Windows computers around the world. Agents aren’t bad, and some are essential. But each one should earn its place, because each one is also a risk.

Before adding software to a device, ask: does the operating system already do this? Very often it does. Windows, macOS, iOS and Android have built-in support for certificates, enterprise Wi-Fi, disk encryption, passkeys and hardware-protected keys. Your device management platform, such as Intune, can configure all of it without installing anything extra.

The best security is the kind nobody notices

Some of the strongest security measures available today are also the most invisible:

• Passkeys and Windows Hello replace passwords with a fingerprint, face or PIN. They are easier than passwords and resistant to phishing.

• Certificate-based Wi-Fi connects devices automatically. There’s no password to type, share or change, and no fake network that can trick users into handing one over.

• Single sign-on means one strong sign-in instead of dozens of weak ones.

• Conditional access evaluates the device and the situation in the background, and only asks the user for more when something is unusual.

These are the measures where security and usability point in the same direction. That’s not a coincidence. When a measure needs nothing from the user, there’s nothing for the user to get wrong, skip or work around.

Spend your friction where it matters

Not all friction is bad. Approving a large payment, accessing sensitive data or changing an admin setting should take an extra step. The point is to treat user patience as a limited budget:

• Spend it on the moments that really matter, so that extra prompts actually get attention.

• Save it everywhere else, by making routine access automatic and invisible.

• Design for failure. When security says no, tell people why and what they can do about it. “Access denied” with no way forward is the start of either a helpdesk ticket or a workaround.

Questions to ask before rolling out a security measure

1. What does the user have to do differently, every day?

2. If they’re in a hurry, what’s the workaround, and is it worse than what we have now?

3. Does it add software to their device, or can the operating system already do it?

4. When it fails, can the user understand and fix it themselves?

5. Could we get the same protection without the user noticing at all?

If the answers worry you, the measure probably needs more design work before it needs more enforcement.

How this shapes what we build

This is why our products don’t install agents on your devices. EasyScep delivers certificates through Intune using the operating system’s own certificate support. EasyRadius works with the Wi-Fi client already built into every device. For the user, the result is a laptop that simply connects. For IT, it means one less thing to roll out, update and troubleshoot.

Security that people don’t have to think about is security they won’t work around.

Next in this series: why the password itself, not the user, is the problem.

Want the next part in your inbox? Subscribe to our newsletter.