60% of Employees Work Around Security Controls. Here’s What That Really Means.
The Stat That Should Stop You in Your Tracks A recent report by Forrester revealed that 60% of employees admit to intentionally working around...
Team CM
Nov 19, 2025 8:00:00 AM
There’s an old security adage: "If it’s too easy, it’s probably not secure." But in our race to streamline, automate, and digitize everything, we've smoothed away the very friction points that once served as subtle checks on risk. In a world of real-time deepfakes, one-click approvals, and AI-assisted deception, it turns out that slow, analog friction still has value.
And it may be our best defense against modern trust exploitation.
Analog friction refers to the intentional insertion of slow, interruptive, and often physical trust signals or actions that force humans to pause, reflect, and reassess a situation before proceeding.
It might look like:
A personal phone call to confirm a financial transfer instead of relying on email.
Physically walking down the hall to double-check a strange request.
A handwritten note, physical badge swipe, or wet signature.
A scheduled delay window for approvals above a certain threshold.
These are actions that interrupt automated momentum. They inject time, space, and often human verification into digital processes that are otherwise frictionless.
Modern attacks exploit speed, automation, and cognitive shortcuts. Social engineers rely on your autopilot. They push urgency, fear, or authority to accelerate decision-making. Analog friction disrupts that script.
Cognitive reset: A pause breaks the momentum of manipulation. Even a few seconds can be enough to re-engage rational thinking.
Out-of-band verification: Moving the channel (from email to voice, digital to physical) throws off attackers reliant on spoofed domains or fake digital identities.
Context switching: Changing the medium (screen to paper, device to human interaction) can resurface intuition and increase scrutiny.
Friction isn’t failure. It’s function. When used strategically, it increases security without killing productivity.
Trust is a feeling—but it can be engineered. Human Risk Management teams can embed analog signals and intentional slowdowns into systems as part of the defense layer.
Some use cases:
Executive wire fraud protection: Require verbal confirmation above $10k, even when the email is authenticated.
AI content review: Add a required human sign-off before publishing AI-generated content on official channels.
HR approvals: Insert multi-step checklists for access revocation or sensitive onboarding processes.
IT change control: Enforce a 24-hour review window for production-level changes, even when urgency is claimed.
Analog interventions work best when they are:
Applied to high-risk, high-value workflows
Supported by culture (i.e., not seen as red tape)
Tuned to real business priorities and threat models

Interruptions create opportunity for higher-order thinking. When humans are forced to slow down, we:
Access critical thinking instead of habitual response
Check assumptions against experience
Remember prior similar incidents or warnings
In other words, we become harder to deceive.
Psychological studies show that trust is more likely to be well-placed when people feel in control of the verification process. Analog friction puts control back in human hands.
This isn’t about turning back the clock. It’s about layering in defense that works at the human level.
Human Risk Management teams should:
Map workflows where trust decisions are made under pressure
Identify where attackers could insert manipulation or deception
Add analog interventions to create speed bumps in those moments
Analog doesn’t scale infinitely, but it doesn’t need to. Use it where it counts—at moments of maximum risk.
In the AI era, trust will be the hardest commodity to verify. Interfaces will become seamless. Voice, image, and language will be flawlessly faked. We’ll need something else to hold onto.
Analog friction gives us a handhold. A chance to check. A space to breathe. A moment to make the right call.
It’s not a step backward. It’s a step sideways—into a safer, more resilient posture.
Want to know where analog firebreaks could protect your people from AI-driven deception? Let us map your risk triggers and show how cultural and cognitive interventions can reduce incident risk.
The Stat That Should Stop You in Your Tracks A recent report by Forrester revealed that 60% of employees admit to intentionally working around...
5 min read
Understanding the Real Reasons Behind Policy Bypass
4 min read
There’s a scene that plays out too often inside security operations centers. An alert pings, a dashboard flares red, and the team moves...
5 min read
Subscribe to our newsletters for the latest news and insights.
Stay updated with best practices to enhance your workforce.
Get the latest on strategic risk for Executives and Managers.