Is the Secure Route the Easiest Route?
TL;DR
- Security friction can push employees to use workarounds that expose organisations to risk.
- Warning signs include access delays, policy exceptions and unofficial tools.
- Effective controls balance protection with productivity and fit real workflows.
- Make the secure option the easiest option through simpler access, authentication and collaboration.
Security is essential for protecting business data, systems and users. But when security controls make everyday tasks harder, people often look for other ways to get their work done.
Can your staff share files through unofficial channels? Perhaps through relaxed access controls, or frequently reused passwords because remembering yet another one adds to their burden. Most of these decisions aren’t malicious. They’re often the result of employees trying to stay productive when processes feel slow, complicated or disconnected from how they actually work.
This creates a difficult balancing act for business leaders. Too few controls can leave the organisation exposed to risk. Too much friction can encourage employees to find workarounds that undermine the very security those controls were designed to provide.
Your new starter begins on Monday, but their laptop is still being configured, software access is incomplete, and permissions have been assigned inconsistently, leaving them unable to hit the ground running. You need to send a document to a supplier before a deadline, but the approved sharing process is unclear or takes too long. An employee is asked to verify their identity repeatedly while moving between systems. In each case, the immediate problem is operational rather than technical: someone cannot do what they need to do, when they need to do it.
Since hybrid working has become the norm, organisations need to extend these practical ways to protect remote work without making everyday tasks harder. Security should support productivity while reducing unnecessary risk wherever the user is.
Security controls fail when they don’t reflect how the business actually works
Security controls are often bypassed when they do not reflect the pace and practical demands of the working day.
A salesperson needs a document while travelling.
A manager needs a new starter productive immediately.
A project team needs to share information with a third party before a deadline.
When security processes can’t keep pace with the needs of the business, people often find an alternative route.
A VPN might be used to make it appear that someone is working from an approved location. An unmanaged device might be easier than the company laptop. Each is different, but the underlying problem is the same: the easier route has bypassed the intended security control.
The result is that organisations can end up with a gap between the security processes they believe are being followed and what is actually happening day to day.
Common signs that security is creating friction
Many organisations already have security controls in place. But do those controls help employees work securely or just encourage them to work around them? In other words, does your security create workarounds?
Warning signs may include:
Individually, these may seem like minor issues. Collectively, they can indicate that security controls are creating operational friction.
The Risks of Security Workarounds and Shadow IT
The challenge with loopholes is that although they often solve an immediate business problem, they are essentially bypassing the implementation of security and access controls agreed for a reason, creating a longer-term and ultimately more costly security problem that needs fixing.
An employee who stores files somewhere more convenient may make collaboration easier today, but reduce visibility, security and control tomorrow.
A manager who grants access quickly to avoid delays may help a project move forward, but leave unnecessary permissions in place long after they’re needed.
Over time, these small compromises can accumulate, making it harder to answer important questions such as:
The organisation may believe it has control, while the reality is far less clear.
How to Reduce Security Workarounds in Hybrid Working
Adding another tool or tightening another policy will not necessarily resolve this friction. The organisation first needs to understand where people are getting stuck, which workarounds they have adopted and whether existing Microsoft 365 controls are configured around the way the business now operates. That requires input from the teams responsible for security, technology, people and day-to-day operations.
There will always be some degree of friction in security. The goal is to ensure that security remains proportionate to the risk while allowing employees to work effectively.
The most successful organisations are often those that strike a balance between protection and productivity. They recognise that if secure behaviour feels unnecessarily difficult, people will naturally look for another way.
Secure hybrid working therefore depends on technology, people and processes working together.
FAQs About Security Workarounds and Shadow IT
Common loopholes include sharing files through personal accounts or unauthorised apps, reusing passwords, bypassing approval processes, using unapproved software and keeping local copies of information outside managed systems. These behaviours are often a sign that the approved process is unclear, too slow or poorly aligned with how employees need to work.
Look for repeated requests for exceptions, delays in onboarding or access, complaints about authentication, unofficial file-sharing methods and teams creating their own processes. Support tickets, employee feedback and process reviews can reveal where controls are slowing routine work or encouraging people to bypass them.
Employees usually bypass controls to complete a legitimate task quickly, not to create risk. Common causes include slow approvals, repeated sign-ins, unclear guidance, missing access and tools that do not support the way people work. Understanding the task behind the workaround helps the organisation fix the process rather than simply impose another restriction.
Start by identifying the processes that generate the most delays or exceptions. Simplify access requests, provide approved collaboration tools, automate device protection and use role-based access so employees receive the right permissions promptly. Clear guidance, regular feedback and proportionate controls help make secure behaviour the easiest option.
How do you make security easier for employees to follow?
Make the secure option the easiest option.
Security is more likely to be followed when the user “owns” the responsibility and it fits naturally into the working day. The aim is to remove unnecessary effort and make the approved route quicker and clearer than the loophole.
REDUCE PASSWORD FATIGUE
A password manager helps employees create and use unique passwords without having to remember every one, or the danger of the same password for multiple logins. Microsoft Entra single sign-on can further reduce repeated logins by giving people secure access to approved applications through one identity.
MAKE STRONG AUTHENTICATION STRAIGHTFORWARD
Passwordless sign-in and Microsoft Authenticator can make identity checks quicker, while avoiding the frustration of relying on passwords alone.
APPLY PROTECTION AUTOMATICALLY
Microsoft Intune can apply security settings to approved devices, reducing the number of steps employees must complete themselves and helping policies remain consistent.
GIVE PEOPLE AN APPROVED WAY TO SHARE AND ACCESS FILES
Clear use of Microsoft Teams, SharePoint and OneDrive makes it easier to collaborate without turning to personal accounts or unauthorised file-sharing tools.
KEEP ACCESS ALIGNED WITH EACH EMPLOYEE’S ROLE
Role-based access and well-managed joiner, mover and leaver processes help people receive the access they need promptly, while removing permissions when roles change or employment ends.
Make secure hybrid working easier for your employees
Vissensa can help you identify where security is creating friction across your hybrid working environment, review how your Microsoft 365 tools and access processes are configured, and design a more joined-up approach. The goal is to make secure working simpler for employees while giving the organisation clearer control over identities, devices, applications and data.
When organisations review their approach to secure hybrid working, they often focus on the controls they need to add.
An equally important question is whether existing controls are helping employees work securely or encouraging them to work around them.
Because what’s the point in having security measures in place if they are so restrictive that your team dismisses their importance and relevance in keeping corporate data safe?
If employees are regularly asking for exceptions, using unofficial tools or finding their own route around security processes, your controls may no longer fit the way your organisation works. Or perhaps you have held back from introducing stronger controls because you are sceptical that your team will adopt them. Vissensa can help you identify the points of friction and put controls in place that people will actually use, making the secure path the easiest one to follow.
