Authentication problems for frontline workers are delaying patient care, production and deliveries across industries, according to Frontline Friction: The State of Authentication for Frontline Workers, a new report from Imprivata and the FIDO Alliance. The survey of 700 IT and security decision-makers responsible for worker authentication at healthcare, manufacturing and other frontline-intensive organizations in the US, UK, France and Germany finds that 34% (rising to 40% in healthcare) report authentication difficulties delaying patient care, production, delivery and/or other frontline work.
The complexity of frontline environments create authentication challenges that result in friction for users. These include delays switching between users on shared devices, password resets and lockouts, connectivity failures, and repeated MFA prompts.
As a result, the scale and impact of authentication issues is substantial. Organizations estimate that 37% of their frontline workers experience an authentication issue in a typical month. Each affected worker is interrupted around 11 times and loses an average of 2.5 hours of working time a month. For an average organization in this survey with around 2,800 frontline workers, it adds up to 32,400 working hours lost annually.
Workarounds compound risk in environments that are already complex
Nearly all organizations (95%) have observed frontline workers using workarounds because of authentication difficulties: staying logged in to avoid re-authentication (40%), attempting to bypass multi-factor authentication or other controls (36%) and sharing credentials (33%). The result is an accountability gap: only 40% of decision-makers are very confident that frontline access can be attributed to the correct individual.
“It’s easy to underestimate the impact of a few extra authentication steps, but when those interruptions happen repeatedly across thousands of frontline workers, the cost adds up quickly. And the consequences go beyond lost time. When security controls don’t match the way people work, they unintentionally create incentives to bypass them,” said Joel Burleson-Davis, chief technology & security officer at Imprivata. “We should be using modern identity and access approaches to remove workflow friction while strengthening our confidence that only appropriate access is getting through to critical systems. That’s how we make both the workforce and the organization more secure.”
AI-enabled impersonation has caught up with conventional attacks
These workarounds add risk to environments that attackers are already probing with AI. 57% of organizations report confirmed or suspected AI-assisted or deepfake employee impersonation in the past 12 months, with 23% confirming an incident. That sits alongside 62% reporting a confirmed or suspected unauthorized account-recovery, password-reset or unlock attempt, and 60% reporting social-engineering attempts targeting the service desk. This new reality is also reflected in how concerned frontline organizations are: 48% are very or extremely concerned about AI-enabled impersonation, the same proportion as for conventional social engineering.
Passwordless is delivering, but most organizations have only gone halfway
To simplify workflows and reduce friction for frontline staff, organizations are turning to passwordless authentication methods, with 99% of those using them reporting at least one benefit. For organizations using passkeys without a password, the most-reported benefits include:
- 38% report faster access
- 36% report improved productivity
- 33% report improved visibility into who is accessing systems
Adoption, however, remains incomplete. Two-thirds of organizations (67%) remain password-based or inconsistent in their approach, and only 5% describe frontline authentication as fully passwordless. While 28% use passkeys or FIDO credentials, only 15% use them without a traditional password, meaning nearly half of passkey users still keep a password alongside.
“The research shows frontline organizations don’t have to trade speed for security. Those using passkeys report productivity gains from a method that is phishing-resistant by design, and many are planning to expand their use,” said Andrew Shikiar, executive director and CEO of the FIDO Alliance. “But passkeys can only truly deliver that protection when they replace the password and weak MFA rather than sit beside them. With AI making impersonation cheap and convincing, and frontline organizations feeling its impact, finishing that transition must now be a priority.”
The full report, Frontline Friction: The State of Authentication for Frontline Workers, is available here.
