I have spent enough years in enterprise security to know the moment a control fails. It is not when an attacker beats it. It is the quiet afternoon when an employee with a deadline finds the control too slow, decides the rule is dumb, and quietly does the work some other way. The file goes to a personal drive. The password gets shared in a message because requesting access takes two days. The shadow tool gets adopted because the approved one needs four clicks and a VPN. Every one of those decisions is rational from where that person sits, and every one of them is a hole I did not see open. That is the failure mode that actually loses data, and it is a failure of design, not of discipline.
The lesson I keep relearning is that security culture is not built by telling people to care more. People already care. They simply care about the thing in front of them, which is their work, and when the secure path is the hard path, they route around it the same way water routes around a rock. So the only security that holds at scale is the kind that is also the path of least resistance. If the safe way is the easy way, you do not need to win an argument with anyone. You just need to build it well.
Friction is the real attack surface
We talk about attack surface as if it is only firewalls and endpoints. The largest attack surface in most companies is the gap between what the policy requires and what people actually do, and that gap is made entirely of friction. Every extra step in the secure workflow widens it. A study of your own access logs will tell you the truth faster than any policy review: find the controls people complain about, and you will find the controls people are quietly bypassing.
I think about it as a budget. Every person has a small, fixed tolerance for security friction before they start cutting corners, and you spend that budget whether you mean to or not. A clumsy login flow spends it. A confusing permissions screen spends it. A data protection rule that blocks a legitimate task with no fast way to get unblocked spends it twice, because now the person both bypasses the rule and resents it. Usable security is the practice of spending that budget only where the risk genuinely warrants it, and refusing to waste it on theater. Most security programs are broke by mid-morning because they spent the whole budget on controls that look rigorous and protect almost nothing.
Make the secure path the default path
The single most effective move in security design is to make the secure option the one that happens when nobody is trying. Defaults are destiny. If sharing a document defaults to the right audience, most documents end up shared correctly without anyone deciding to be careful. If new data is private until deliberately exposed, the careless case is the safe case. I design every control in Atlas this way: the lazy path and the safe path should be the same path, so that doing the right thing requires no virtue at all.
This is why I argue that security should feel like a feature rather than a tax. A feature is something a person reaches for because it helps them. A tax is something they pay because they have to, and they minimize it every chance they get. When access requests resolve in seconds instead of days, people request access instead of borrowing a colleague's session. When the audit trail is also a useful activity feed, people stop seeing logging as surveillance and start using it. The control did not change its security value. It changed its felt cost, and felt cost is what determines whether people comply.
Example: imagine a rule that external file shares require approval. Compliance is terrible, not because anyone is reckless, but because approval means a message to a manager who might be offline for hours. The fix is not to strengthen the rule. Make approval a one-tap action that lands in the approver's normal inbox with full context, resolvable in seconds from a phone. Compliance goes from something no one would put in writing to near total, and nothing about the policy changed. The friction did.
Where usable security gets hard
I am not going to pretend every control can be made frictionless. Some genuinely cannot, and enterprise security is partly the discipline of knowing which ones those are. Strong authentication on a sensitive system is worth real friction, and you should not apologize for it. The mistake is applying that same weight everywhere, which trains people to treat all security as an obstacle and erodes the goodwill you need for the controls that actually matter. Spend friction like a scarce resource, because it is one.
The other hard part is that the easy path and the safe path drift apart over time as products change and people find new workflows. A control that was the natural way to work last year becomes a detour after a redesign, and the bypasses start again. So usable security is not a one-time design exercise. It is an ongoing practice of watching where people struggle and treating every workaround as a bug report about your own controls rather than a discipline problem with your people. When someone routes around a rule, my first question is what we built wrong, not what they did wrong.
The culture this builds
When the secure path is the easy path, something quietly shifts in how people relate to security. They stop seeing it as the team that says no and start treating it as part of how the tools work. Reports go up, because reporting is easy and nobody is punished for the friction of doing the right thing. Trust builds in both directions. That is the real prize, and it is the foundation of data protection that survives contact with a busy organization: not a thicker policy binder, but a company where the safe choice is the obvious one and almost no one ever has to think about it.
This is the principle the whole platform is built on, because the same logic that keeps any organization safe is what a product owes the people who run their work on Atlas. Security that people route around protects no one, however rigorous it looks on paper. Security that is also the easiest way to work is the only kind that is still standing at the end of a hard quarter. Make the secure path the easy path, and you will have spent far less of everyone's patience to get far more of their actual safety.