The Path of Least Resistance
Employees bypass controls that cost them time. Human-centric security design makes the secure way the easy way — and the evidence says it works.
Ask employees whether they have taken a security shortcut, and the honest answer is usually yes — and they knew better at the time. In Proofpoint's 2024 State of the Phish survey, 71% of working adults admitted to a risky action like reusing a password or clicking a link from an unknown sender, and 96% of them did so knowing the risk. Gartner's research found the same shape: among employees who admitted unsecure actions, over 90% knew their behavior would increase risk to the organization and did it anyway. That is not an awareness gap. It is a pricing problem: the secure path costs the employee more — in time, clicks, and interruptions — than the risky path, and people reliably pay the lower price.
Human-centric security design is the discipline that takes this finding seriously. Instead of treating the workforce as a compliance target that must be trained and policed into following expensive procedures, it designs the controls, defaults, and processes around how people actually work — so that the secure way to do a task is also the fast way. Gartner, which named the approach one of its top cybersecurity predictions, expects that by 2027 half of large-enterprise CISOs will have formally adopted human-centric design practices, precisely "to minimize operational friction and maximize control adoption." This guide covers the evidence behind the approach and a practical path to applying it.
Rational people, expensive rules
The motives employees give for risky behavior are strikingly mundane. In the Proofpoint data, the top reasons were convenience (44%), saving time (39%), and urgency (24%) — not malice, not confusion. The same survey exposed a telling perception gap: 85% of security professionals said most employees know they are responsible for security, while 59% of employees either weren't sure or disagreed. The program believes it has communicated; the workforce has mostly registered an obstacle course.
Meanwhile the stakes keep not moving in security's favor. The Verizon 2026 Data Breach Investigations Report attributes 62% of breaches to the human element — and the standard institutional response, more mandatory training, has a weak record when deployed as an annual compliance exercise. In an eight-month study of roughly 19,500 employees, Ho et al. (IEEE S&P 2025) found no significant relationship between recent completion of annual awareness training and the odds of failing a simulated phish — and observed that about 75% of employees closed the embedded training page within one minute. Employees treat low-value training the way they treat every other high-friction control: they find the fastest path through it.
Every workaround in your organization is a design review you never asked for. An employee found the secure path too expensive — and billed you the difference in risk.
Fatigue is a design flaw, not a character flaw
There is a name for what accumulating security demands do to people. In an interview study, NIST researchers set out to understand how users perceive cybersecurity and found something they weren't looking for: a pervasive weariness they termed security fatigue — "a weariness or reluctance to deal with computer security." Fatigued users, the study found, avoid decisions, choose the easiest available option, act on impulse, and quietly stop following rules. "We weren't even looking for fatigue in our interviews," said researcher Mary Theofanos, "but we got this overwhelming feeling of weariness throughout all of the data."
The study's remedies read like a design brief, not a training plan: limit the number of security decisions users must make, make it simple for them to choose the right action, and design for consistency. Her co-author, cognitive psychologist Brian Stanton, put the stakes plainly: "If people can't use security, they are not going to, and then we and our nation won't be secure." A decade later, the same dynamic has a dashboard equivalent in alert fatigue — and the same lesson: attention is a finite budget, and every control spends from it.
The standards already moved
If human-centric design still sounds like a concession to convenience, consider that the most-cited password guidance in the world has already adopted it. NIST's SP 800-63B, revised in August 2025, states that verifiers shall not require periodic password changes, shall not impose composition rules, and shall allow password managers, autofill, and pasting — because decades of evidence showed those frictions produced predictable, incremented, reused passwords rather than strong ones. What replaced them asks more of systems and less of people: longer passphrases, breach-list screening, and tooling that removes the memorization burden entirely.
That is the general pattern. The controls that generate the most daily friction are frequently the ones buying the least security, and the redesign is usually stronger, not weaker:
| Control as commonly deployed | The friction it creates | What people actually do | The human-centric redesign |
|---|---|---|---|
| 90-day password rotation + complexity rules | Dozens of evolving secrets to memorize | Increment, reuse, write down | No forced rotation; long passphrases; a deployed password manager with autofill |
| Blanket ban on unapproved tools | Work stalls waiting for procurement | Personal accounts, shadow IT and shadow AI | A sanctioned catalog, fast request path, and enterprise accounts that absorb the demand |
| Punitive phishing simulations | Fear of blame for one wrong click | Clicks go unreported; incidents stay hidden | Blame-free reporting measured and celebrated as the primary metric |
| Annual 45-minute training module | An hour taken from real deadlines | Click through in a minute | Short, spaced, role-relevant lessons on the cadence memory research supports |
A friction audit, in six steps
Human-centric design becomes practical the moment you treat friction as something you can inventory and fix. A workable program:
- Audit the five workflows that matter. Pick the most common tasks that touch a control — external file sharing, software requests, password resets, payment-change approvals, MFA enrollment. For each, measure time-to-comply and time-to-bypass. Wherever the bypass is faster, the control exists on paper only.
- Fix defaults before behavior. Single sign-on that removes logins, a password manager provisioned to everyone, phishing-resistant MFA that eliminates codes and push prompts, and pre-approved tools installed by default each delete whole categories of daily security decisions — NIST's first remedy for fatigue, applied literally.
- Build paved roads for the top workarounds. Shadow tool discoveries and exception requests are demand signals, not disciplinary cases. Each one names a task where the sanctioned path lost on price; redesign the path, and the workaround's market disappears.
- Make the remaining asks few and well-timed. A security nudge at the moment of risk — an external-sender banner on a reply, a verification prompt on a new payee — outperforms a policy document nobody rereads, and spends far less attention.
- Keep the friction that earns its cost. Out-of-band callbacks for bank-detail changes, approval for new OAuth grants, identity verification at the help desk: these frictions stop real attacks. Human-centric design makes them fast, scripted, and routine — it does not delete them.
- Measure adoption as a security metric. SSO and manager coverage, report rate and time-to-report, verification compliance, shadow usage trending down. Folded into a per-team human risk score, they show whether the redesign is winning — before the incident count has to prove it either way.
Designing for the workforce you actually have
The strategic argument is that the alternative is already failing at scale. Gartner's same prediction set expects 75% of employees to acquire, modify, or create technology outside IT's visibility by 2027 — up from 41% in 2022. A security program built on the assumption that it can see and veto everything is designing for a workforce that stopped existing; the CISO's job, in Gartner's framing, shifts from control owner to risk decision facilitator. What remains controllable is the price of doing the right thing.
That reframe is also what human risk management adds to traditional awareness programs: measure where the workforce's real behavior diverges from the secure path, fix the design where friction is the cause, train where knowledge is the cause, and track both on one trend line. Employees have been voting on your controls all along — with their workarounds. Human-centric design is the decision to count the votes.
Frequently asked questions
What is human-centric security design?
Human-centric security design is the practice of designing security controls, processes, and training around how people actually work, rather than expecting people to reorganize their work around the controls. In Gartner's phrasing, it is security 'modeled with the individual' — not the technology, the threat, or the location — as the design center, with the explicit goal of minimizing the friction that drives employees to bypass controls. Gartner predicted that 50% of large-enterprise CISOs will formally adopt human-centric design practices by 2027.
Does reducing security friction mean accepting more risk?
No — the point is to remove friction that buys no security, not to lower the bar. Forced password rotation and arbitrary complexity rules are the canonical example: they generate enormous daily friction and NIST's current guidance explicitly rejects both, because they push people toward predictable, reused passwords. The redesign replaces them with stronger controls that demand less of the user — longer passphrases without expiry, a deployed password manager, phishing-resistant MFA. Friction that genuinely stops attacks, like out-of-band verification for payment changes, stays; the redesign makes it fast and routine rather than removing it.
How do we find out where our security friction actually is?
Run a friction audit. Pick the five most common workflows that touch a control — sharing a file externally, requesting software, resetting a password, approving a payment change — and measure two numbers for each: the time it takes to comply, and the time it takes to bypass. Wherever the bypass wins, you have found a control that exists on paper but not in practice. Exception requests, help-desk tickets, and shadow IT discoveries are the same signal arriving through other channels: each one is an employee telling you where the secure path costs too much.
How do we measure whether human-centric changes are working?
Measure adoption and voluntary behavior, not just incidents. Useful indicators: the share of logins going through SSO and the password manager, phishing report rate and time-to-report, the share of payment changes verified through the defined channel, shadow tool usage trending down as sanctioned alternatives absorb demand, and security exception requests falling because the default path works. Folded into a per-team human risk score, these turn 'we redesigned the control' into a trend line you can show the board.
NOUSEC simulates attacks across 8 channels and turns the results into one number your board can read.
Book a demo