Is the "Assume Breach" mentality of Zero Trust causing unnecessary friction for employees?

All answers to this question.

This is where "Risk-Based Authentication" comes in. Zero Trust doesn't have to mean "MFA every five minutes." Instead, the system should look at signals: Is the developer on a known corporate laptop? Is their location consistent with their home office? Is their device's patch level up to date? If all these "signals" are green, the system can grant a transparent 8-hour session token. You only trigger a hard MFA prompt if a signal changes—like if they suddenly log in from a new IP address or try to access a highly sensitive production database. This provides the security of "continuous verification" while keeping the friction extremely low for standard work.

   Answered 2024-11-18 by Linda Young

Are you using a modern SSO provider that supports "Session Orchestration" to pass identity context between your different SaaS tools and internal apps?

   Answered 2024-11-20 by David Johnson

• We are using Okta, but we haven't fully configured the "Passwordless" features yet. Do you find that moving to biometric-based auth (like TouchID or Windows Hello) helps reduce the psychological friction of Zero Trust, even if the actual number of "checks" stays the same? Developers seem to hate typing passwords but don't mind a quick fingerprint scan.

     Commented 2024-11-22 by Joseph Rodriguez

We implemented "Device Trust" via certificates. If the certificate is present and valid, the user gets a seamless experience. If it's missing, they get blocked. Simple and effective.

   Answered 2024-11-24 by Heather Garcia

• I agree, Heather. Certificate-based auth is the unsung hero of a smooth Zero Trust rollout. It’s highly secure but completely invisible to the end user.

     Commented 2024-11-25 by Patricia Lewis