A security control is being circumvented by most of the team. What do you conclude and what do you do?

What is being tested

Whether you treat the workaround as a design finding rather than as a discipline problem.

What to conclude

The control is not working, and you now know exactly where the pressure is.

A circumvented control provides no protection while creating the belief that it does — which is worse than having no control, because the risk is unmanaged and unrecognised.

The behaviour is not a discipline failure. People are trying to do their jobs, and the control made the correct path harder than an incorrect one. That is a design outcome, and design outcomes are fixed by redesign, not by reminders.

The workaround is the most valuable security finding available, because it identifies both the failing control and the legitimate need it obstructed.

What to do

1. Understand the workaround precisely. What are people doing, and what were they trying to achieve? Without judgement, or you will not get accurate information — and accurate information is the whole point.

2. Assess the actual risk of the workaround, which is frequently worse than what the control prevented. Shared accounts, credentials in a spreadsheet, an unapproved tool holding production data.

3. Redesign for the legitimate need. Almost always the need is real. The question is how to serve it safely: - Self-service with logging and time limits rather than a request queue. - Break-glass elevation that is instant, logged and automatically notified — so the emergency path exists inside the system rather than outside it. - A safe tool that is genuinely easier than the unsafe one.

4. Apply friction proportionate to risk. Step-up authentication for a payment change, not for reading a dashboard. Uniform friction desensitises people, and desensitised people approve everything — which defeats the mechanism entirely.

The false trades to exhaust first

Cases where security and usability improve together, and which should be adopted before any genuine trade is made:

• Passkeys and modern authentication — more secure and easier than passwords.
• Single sign-on — one strong authentication instead of many weak ones.
• Short-lived credentials issued automatically, replacing long-lived secrets people copy and share.
• Secure defaults, so the safe path requires no effort.
• Automated dependency updates, removing a manual task and a vulnerability class together.

The principle to state

A control that is circumvented is less secure than a weaker control that is followed.

Password rotation policies producing predictable increments on sticky notes; VPN requirements producing shadow tools; approval processes producing shared accounts. In each case the strict control produced a worse outcome than a moderate one, because behaviour adapted.

What a strong answer adds

That this should be detected deliberately rather than discovered. Monitoring for the signatures of workarounds — shared credential use, unapproved tools, access patterns that suggest a bypass — is a security capability, and it finds these things while the risk is still small.