Security friction moves behaviour elsewhere
Make the approved route painful and people find another one, which you cannot see.
Blocked file sharing becomes personal cloud accounts. A slow VPN becomes a home machine. A long approval process becomes an unrecorded change. The friction did not stop the behaviour, it relocated it beyond your monitoring, which is strictly worse than the thing you were preventing.
More on Human factors
- Phishing exploits context, not stupidityIt fitted the gap
- A warning ignored every day stops being a warningThe bell nobody hears
- MFA fatigue weaponises repetitionAsk forty times
- Verify suspicious requests through a separate channelRing back on a line they never gave you
- People need a safe way to report mistakes quicklyThe shortest road back
- Security training decays without practiceWhat you knew in March