Make secure access easier wherever work happens

This Cybersecurity Awareness Month, make security the easy choice.

In industries where work moves quickly, security is often discussed as if it exists in just one place: the data center, the cloud, the network, or the endpoint.

Frontline workers experience it differently.

Security is present every time they move between tasks, applications, devices, and locations. Clinicians move between shared workstations, mobile devices, and clinical applications. Public safety professionals use digital tools in vehicles, dispatch environments, and the field. Manufacturing employees move between shared endpoints, production systems, and cloud applications.

The technology they’re using may change, but workers — and their need for fast, secure access — do not.

That distinction matters.

Complex hybrid environments can frustrate frontline workers through repeated logins, inconsistent access rules, slow user switching, and blocked workflows. If we want the secure choice to also be the easy choice, security can’t become harder every time the task, location, or technology changes.

The fragmented identity experience of frontline work

Organizations often describe their environments in terms of infrastructure: legacy and modern applications, on-premises and cloud systems, shared and individual devices.

But frontline work rarely fits neatly into those categories. Workers may use an individual device for one task, a shared device for another, and a specialized system that requires a completely different access method for a third. They may work across applications managed by different teams, with different authentication capabilities and different session policies.

The result isn’t just a diverse technology estate. It’s a fragmented identity experience.

New research from the FIDO Alliance shows how blended the frontline environment has become. Eighty-seven percent of surveyed organizations use at least one type of individual device for frontline work, while 83% use at least one type of shared device. Among organizations using shared devices, half said that most or nearly all frontline workers use them.

These findings challenge the idea that organizations can design authentication around a single device model. Individual and shared devices often coexist within the same environment, and shared access is frequently a core operating requirement rather than an edge case.

The challenge is creating an identity experience that works across both shared and individual devices, as well as the applications users need once they're authenticated.

When identity doesn’t travel, friction follows

The FIDO research found that 96% of organizations using shared devices reported at least one authentication or access management challenge. The top challenges included maintaining accurate access records (47%), supporting consistent authentication across different device and system types (45%), and enabling fast, secure user switching (43%).

These findings point to a broader issue than device configuration. They show how difficult it can be to preserve a consistent, accountable identity experience when people move between different access environments.

The same research found that only 38% of organizations report all or nearly all frontline workers use unique credentials, with 61% still using shared or generic accounts. Among organizations that don’t consistently use unique credentials, the leading reasons were frequent user switching (39%), workflow barriers (38%), and shared devices (38%).

The problem isn’t the diversity of devices and systems. It’s what happens when workers’ identities don’t travel cleanly across them.

Users may need to repeatedly authenticate as they move between devices or applications. They may use different credentials for different systems. On shared devices, they may need to manually sign in and out in ways that make secure user switching cumbersome.

Over time, these small obstacles can encourage risky workarounds that let users get the job done, but open the door to trouble.

Workers may remain logged in because switching sessions takes too long or ask to share a colleague’s password to a system they were locked out of. Even security professionals may need to make less-than-ideal choices in the name of productivity, such as creating a security exception to enable an application that can’t integrate with broader controls.

These aren’t deliberate attempts to make environments less secure. They’re responses to a system that doesn’t fit the pace or structure of the work.

But even when the choices are understandable, the result is the same: weakened security and accountability. Shared credentials make it harder to establish who performed an action. Persistent sessions can expose sensitive information to the next person using a device. Manual workarounds create discrepancies between an organization’s policies and the processes people actually follow.

Don’t make workers bridge the gaps between systems

When technologies don’t work together, organizations often compensate with more policy and process. Eventually, that burden lands – heavily – on the user. They have to remember another password, authenticate again, manually sign out before changing workstations, use a different method for an older application, or contact the service desk after a lockout.

Each step looks small in isolation, but repeated across every shift, the burden compounds, creating friction. The identity layer should bridge the gaps between technologies, so workers don’t have to.

Consistency doesn’t mean applying identical controls everywhere. Accessing patient records, production systems, or financial data may require stronger verification than viewing a company intranet page. The objective is to give users a predictable way to establish trust while allowing organizations to apply stronger or more context-aware controls when risk levels change.

Modernization shouldn’t be a prerequisite for better identity security

Mission-critical organizations rarely replace their entire technology stack at once. Legacy applications may remain essential for years as cloud, mobile, and operational technologies are introduced around them. Security leaders need ways to improve identity security while modernization continues.

Three considerations can help:

Create a consistent way to establish trust

Authentication should feel familiar to workers across all environments. Single sign-on, passwordless authentication, proximity-based access, biometrics, and other methods can reduce the need for users to remember and repeatedly enter credentials.

The best approach depends on the workforce, device, application, and risk. The objective is to make establishing trust clear and predictable, even when the underlying technology differs.

Separate the identity experience from individual application limitations

Legacy applications shouldn’t dictate the security experience for an entire organization. An integrated access management layer can often extend advanced authentication approaches across legacy and modern environments.

This can help organizations maintain stronger access controls and preserve individual attribution without tearing out and replacing technologies.

Design for movement

Frontline identity security should assume that workers will change devices, workstations, applications, and locations throughout the day.

Secure handoffs, individual attribution, fast user switching, session management, and context-aware authentication should be part of the design. Shared-device access shouldn’t be treated like an exception to the identity strategy. In many industries, it’s central to how work gets done.

Five questions for security leaders

This Cybersecurity Awareness Month, consider asking:

• Where does changing a device or application also change the user’s security experience?
• Where are users repeatedly authenticating after their identity has already been established?
• Which shared device workflows make secure user switching or individual attribution difficult?
• Where are legacy systems creating exceptions to broader identity policies?
• Can we improve consistency without waiting to modernize every application and endpoint?

The answers may point to a need for a stronger identity layer, rather than more controls. Frontline workers shouldn’t need to understand the complexity of the systems they use in order to work securely.

Making security the easy choice means giving people a familiar, trusted way to access what they need, wherever the work takes them.

The question of who — or what — deserves access is becoming more complicated. In the final installment of this series, we will look beyond human users to the emerging identity security challenges posed by non-human identities and agentic AI.