A look at some of the challenges of zero-trust systems that can create friction for users and employees, as businesses increasingly adopt them to fight hackers
Christopher Mims / Wall Street Journal :
Context & Ripple Effects
Zero-trust moved from vendor pitch to policy when the White House ordered federal agencies toward zero-trust architectures with hardware-based authentication in January 2022. Eight months later, the Wall Street Journal is cataloguing the cost side of that mandate: constant verification creates friction for users and employees, and the baseline remains low — only about 22% of companies use multi-factor authentication.
First-order effects
- Employees at adopting firms now face repeated authentication and access checks inside everyday workflows, trading convenience for breach resistance.
- For the large majority of companies not yet using MFA, the reported friction raises the perceived cost of starting, even as hackers make standing still riskier.
Second-order effects
- Vendors that score users silently rather than challenging them — the approach behind [[a:940377|fraud-detection services like Sift and SecureAuth generating trustworthiness scores from thousands of signals]] — gain an opening to sell friction reduction as the complement to zero-trust enforcement.
- Identity and authentication providers can price against the pain point itself, bundling smoother verification into zero-trust packages as enterprises weigh the employee-experience backlash.
Third-order effects
- If government mandates keep pulling and user friction keeps pushing back, verification becomes a structural bottleneck in how work gets done — the durable problem this coverage maps onto is the [[/concepts#verification-bottleneck|verification bottleneck]].
- The gap between policy ambition (federal directives) and actual adoption (22% MFA usage) sets up regulators to treat authentication practices as a compliance matter rather than a choice, echoing the accountability questions raised when oversight bodies like the Cyber Safety Review Board skip inquiries into exploited weaknesses.
The trend: Security architecture is shifting from perimeter defense to continuous per-user verification, with employee friction — not technology — setting the pace of enterprise adoption.