Users neither design nor operate the security architecture. Why does the design still depend on them?
Because their whole perception of it is its usability — and measures perceived as cumbersome, laborious, disruptive or obstructive get worked around, which quietly deletes the protection.
* The loop that deletes a control: friction, workaround, lost protection, more controls. *
The mechanism is not malice. People are measured on getting their work done. When a control stands between them and that, a bypass appears: the shared password, the personal cloud drive, the exported spreadsheet, the propped-open door, the ticket asking for a permanent exception. The control is still in the architecture diagram and no longer in the world.
The user groups differ in how failure shows up:
| Users | Bad usability produces | Bad security produces |
|---|---|---|
| Employees | Workarounds — security is circumvented | Internal incident |
| Customers | They switch provider | An incident with external effect: reputational damage on top of the loss |
| Partners | Friction in the business relationship, pressure for exceptions | Incidents that propagate along the connection |
Two design consequences:
- Accompany appropriate measures with suitable communication. If people understand why a control exists, they tolerate it and stop treating it as an obstacle course. Unexplained measures are experienced as harassment.
- The best measures make daily work easier, not harder. The classic example: replacing long, complicated, frequently-rotated passwords with a proper authentication key — a hardware security key or passkey. The user does less work, the phishing resistance goes up, and nobody has to be persuaded. When security and convenience point the same way, adoption stops being a project.
Tip: if you need an awareness campaign to make a control stick, treat that as a design smell, not as the plan.
Go deeper:
NIST — "Security Fatigue" can cause users to act recklessly — the study behind the bypass behaviour: too many security decisions and people stop making them well.
FIDO Alliance — Passkeys — the concrete example of security that is easier than what it replaces, with the sign-in numbers.