When risk rises, security should get smarter, not harder

This Cybersecurity Awareness Month, make security the easy choice.

Security teams have good reasons for adding steps to the access process. Ask for another factor. Require another approval. Limit what a user can reach. End a session when the work is complete.

Each of these controls can reduce risk. But the problem begins when every user, resource, and access request receives essentially the same treatment.

An established employee signing in as usual is different from a caller requesting help recovering an account. A vendor accessing critical infrastructure raises different considerations than an employee doing routine work.

The goal isn’t frictionless security at all costs. It’s purposeful friction: adding assurance when the risk justifies it and getting out of the way when it doesn’t.

That’s a crucial distinction. Making the secure choice the easy choice should never mean weakening controls to make security more convenient. It should mean designing security so that routine, lower-risk work is simple while higher-risk situations receive the scrutiny they require.

Start with context

Traditional access policies often begin with a relatively static question: Does this identity have access? But modern identity security needs to ask more.

Who is requesting access? What are they trying to reach? Where are they connecting from, and what device are they using? What level of privilege is involved? Does the behavior match what the organization expects? Does anything about this interaction warrant additional assurance?

The answers can determine what happens next. An access request might proceed normally, require stronger authentication or identity verification, receive limited privileges, or be blocked altogether.

This is the principle behind adaptive security: access decisions should reflect an interaction's context and risk. A familiar login from an expected device may not require the same controls as an unusual request for sensitive information.

When additional controls are triggered by risk rather than applied indiscriminately, security becomes easier for most legitimate interactions. Users aren’t repeatedly challenged without cause, while security teams retain the ability to respond when circumstances change.

Know who is on the other side of the credential

Authentication tells you someone possesses something that can be used to authenticate — a password, token, device, or other factor. But certain moments require greater confidence that the person presenting a credential is the person authorized to use it.

That’s where identity assurance becomes important.

Organizations should consider stronger identity verification during moments such as:

• Initial enrollment
• Credential issuance
• Account recovery
• Password or authentication resets
• Requests for sensitive access
• Changes to identity information
• Suspicious or unusual access events

Rather than treating identity verification as a one-time onboarding activity, organizations should apply it throughout the access lifecycle when fraudulent access could have especially serious consequences. For example, an account recovery process designed to be convenient for a legitimate user can become an avenue for account takeover if the organization has insufficient confidence in the person making the request.

Strong verification at the right moment helps organizations establish greater confidence in a user’s identity without repeatedly burdening that user throughout the rest of the access experience.

Privilege changes the equation

Some identities do more than access information or applications. They can change configurations, administer systems, create accounts, alter permissions, or reach sensitive infrastructure.

For these users, asking “Can this person log in?” is insufficient.

Security leaders also need to consider:

• What does this person need to do?
• Which resources are required for that task?
• How much privilege is necessary and for how long?
• What happens when the work is complete?
• Can the organization see and audit what occurred during the session?

These questions support a least-privilege approach. Rather than providing broad, persistent access because it’s operationally convenient, organizations can make limited, task-appropriate, time-bound access the default.

Least privilege works best when it’s easier to use than standing privilege. If requesting the right level of access creates delays or administrative obstacles, users and administrators may have incentives to preserve broad access “just in case.” That can leave sensitive systems exposed long after the original need has ended.

The secure path must work for the administrator, too. Time-bound access, approval workflows, credential management, session monitoring, and timely revocation should support the work without turning every privileged task into a manual exercise.

Third parties test whether your security model extends beyond your workforce

Organizations increasingly depend on vendors, contractors, service providers, and other third parties that need legitimate access to critical systems.

The business requirement is straightforward: They need to get in and do their jobs.

The security questions are harder. Who are they? What should they reach? When should they have access? What can they do once they’re in? How do you know when access should end?

When organizations lack an easy, purpose-built path for third-party access, convenience can win. Teams may rely on shared credentials, persistent accounts, broad network access, or manual processes that are difficult to maintain and monitor.

A more strategic security model makes it straightforward to:

• Establish and verify the third party’s identity
• Grant only the access required
• Limit access to appropriate systems
• Set time boundaries
• Monitor activity
• Remove access when the engagement ends

This is another example of purposeful friction. A third party shouldn’t necessarily receive the same access or level of assurance as an employee doing routine work. But the organization should apply the right level of control without creating so much friction that people resort to workarounds.

Friction also impacts security teams

Security friction isn’t only experienced by end users.

Manual approvals, vendor onboarding, credential rotation, access reviews, session investigations, and deprovisioning all create work for security and IT teams. When secure processes require excessive administration, organizations may compensate by granting broader or longer-lived access simply because it’s easier to manage.

Making security the easy choice means designing controls that are practical for the teams enforcing them, not just for the people who need access.

Automation can help make secure practices the default rather than another task in someone’s queue. Time-bound access can expire without a manual reminder. Credentials can be managed without spreadsheets or informal exchanges. Access can be revoked promptly when a role changes or an engagement ends. Session activity can be captured to support both oversight and investigation.

The objective isn’t to automate judgment out of the process, but to reduce the administrative burden that makes strong controls difficult to apply consistently.

Ask whether every security step earns its place

Security leaders should ask targeted questions to evaluate their access security processes:

• Where are we applying the same authentication requirements regardless of risk?
• At which moments do we need greater confidence in the person behind the credential?
• Where does standing privilege exist because it is easier to administer?
• Is properly governed third-party access as easy or easier than the workaround?
• Where does security create unnecessary work for the security team itself?
• Which manual processes make stronger access controls difficult to maintain consistently?

Making security the easy choice isn’t about eliminating security steps. It’s about making every step earn its place.

Routine, trusted access should be simple. When context changes, privilege increases, or a third party enters the environment, security should apply the additional assurance required.

The goal isn’t more friction or less friction. It’s the right assurance, for the right access, at the right moment.

In our next installment in the series, we'll explore how organizations can make secure access consistent as workers move across devices, applications, and workflows.