Security wants mandatory hardware keys for every login; the business says it will cost conversions. How do you resolve it architecturally rather than by picking a side?

What the interviewer is testing

Whether you treat security as a fixed dial to be turned up, or as a risk-proportionate design variable. Both stated positions are reasonable and both are wrong as stated.

Why "pick a side" fails

Maximum friction on every action drives users to workarounds — shared accounts, written-down codes, abandoned sign-ups — which frequently produce a worse security outcome than the moderate control they replaced. Minimum friction leaves high-value actions unprotected.

The resolution is that security posture should vary with the value and reversibility of the action, not be uniform across a session.

The architectural answer: step-up authentication and risk-based access

Tier the actions. Reading a dashboard, changing a password, adding a payee, exporting the customer database and changing production configuration do not deserve the same gate.

Authenticate once at a baseline, then step up for consequential actions. The user proves identity more strongly at the moment it matters, rather than at the moment they arrive — which is also when they are most willing to, because the reason is obvious to them.

Make the baseline risk-based. Known device, known location, recent authentication and normal behaviour justify a lighter touch; a new device from a new country justifies more. This is where the conversion cost mostly disappears, because the majority of legitimate sessions are low-risk.

Choose phishing-resistant factors where you do step up. Passkeys are both stronger than SMS or TOTP and lower friction — a fingerprint rather than typing a code from another device. This is the part that dissolves the trade-off rather than balancing it: the security and usability objectives point the same way.

How to have the conversation

Get both sides to quantify. Security: what is the expected annual loss from account takeover at each posture? Business: what is the measured conversion delta — measured, via an experiment, not asserted. Very often the assumed friction cost is much larger than the real one, and the debate resolves itself once someone runs the test.

Then agree the tiering explicitly, write it down as a policy, and revisit it when the fraud numbers move.

What a strong answer adds

Noting the asymmetry in who bears each cost: the business owns the conversion loss, security owns the breach risk, and neither owns the other. Tiering is what lets each be optimised where it applies instead of one being traded wholesale for the other. And noting that the highest-value target is usually internal administrative access, where friction costs almost nothing and is routinely weaker than the customer-facing control.