Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Your Security Team Is Trading Control For Speed
Transcript
- Lucas: Look, if you’ve been in enterprise tech long enough, you know the pendulum swings. We spent the last decade obsessed with perimeter defense, building moats and walls. Then came the cloud, and suddenly the perimeter vanished. Now, we’re in this weird limbo where everyone talks about Zero Trust, but nobody seems to agree on what that actually costs the people trying to do their jobs. Luna: Exactly. It’s like we built a fortress so impenetrable that even the owners can’t get in without three forms of ID and a blood sample. Lucas: Right, and here’s the thing most leaders miss when they’re approving these budgets in Q3 of 2026. They aren’t just buying software; they’re buying friction. And friction is invisible until it starts bleeding productivity. I was looking at some internal telemetry from a mid-sized logistics firm last week. Their login success rate dropped by eighteen percent after they rolled out a new multi-factor authentication mandate. Eighteen percent. Luna: That’s not a security win; that’s an operational tax. Are they losing hours or just money? Lucas: Both. But mostly time. Think about a warehouse supervisor who needs to pull up a shipping manifest on a tablet while standing in the rain. If that login takes forty-five seconds instead of five, and they have fifty manifests a day, you’re talking about nearly two hours of lost labor per shift. Multiply that across a thousand sites, and you’re looking at millions in idle time. The security team sees fewer alerts. The business sees slower throughput. Luna: So the CISO is happy because the dashboard looks green, but the COO is furious because the trucks aren’t moving. Lucas: Precisely. And this brings us to the core tension we need to unpack today. How do you balance the absolute necessity of verifying identity against the reality that your employees are human beings with attention spans and lives? Because right now, the industry standard feels less like 'trust but verify' and more like 'verify everything, assume nothing, and inconvenience everyone.' Luna: It feels like we’re solving for the worst-case scenario every single time, which means the best-case scenario never gets to happen efficiently. Lucas: Before we dig into the mechanics of that trade-off, I want to pause for a second. If these conversations are useful for what you're building or running, and you want to keep this network ad-free and independent, consider supporting the show directly. You can find us at buy me a coffee dot com slash fexingo — that's F. E. X. I. N. G. O. Luna: Yeah, any extra support helps us keep digging into these niche corners of tech and business without needing advertiser pressure. Lucas: Thanks for that. Now, back to the grind. Let’s talk about the mechanism causing this friction. It’s usually called 'step-up authentication.' That’s when the system decides your initial login isn’t good enough for a specific action—like accessing payroll or changing vendor details—and throws up another gate. Biometrics, hardware keys, SMS codes. It’s supposed to be smart risk assessment. Luna: But does it actually assess risk, or does it just assess convenience? Because from the user’s side, it’s just another barrier. Lucas: That’s the crux of it. The algorithms might be sophisticated, analyzing IP addresses, device health, and behavior patterns. But if the algorithm triggers a step-up auth for a routine task during a high-stress moment, the user doesn’t think, 'Ah, the AI detected a subtle anomaly.' They think, 'This technology is broken again.' And then they go to IT helpdesk. Or worse, they start bypassing it. Shadow IT comes back into play. Luna: So the very tool meant to secure the enterprise ends up pushing people toward unsecured workarounds. That’s a classic unintended consequence loop. Lucas: It is. And we see this in the numbers. When we look at adoption rates of new security tools, there’s often a steep drop-off curve. Not because the tool doesn’t work, but because the cognitive load is too high. Employees are already managing ten different SaaS platforms, four email threads, and three project management boards. Adding a complex authentication step feels like the final straw. They’ll use a password manager that stores weak credentials just to avoid the MFA prompt. Luna: Which defeats the entire purpose. You’re trading a controlled risk for an uncontrolled one. Lucas: Exactly. So, what’s the alternative? Because we can’t just go back to passwords. We all know how bad those are. The answer isn’t less security; it’s smarter context. We’re seeing early movers implement something called 'adaptive identity.' Instead of hard gates, they use continuous signals. Does the device match the usual pattern? Is the location consistent? Is the user behaving normally? Luna: So instead of asking 'Who are you?' every five minutes, it asks 'Is this still you?' based on behavior. Lucas: Spot on. It’s much harder to spoof a behavioral biometric pattern than it is to steal a static password. If you’re typing at your normal speed, using your usual apps, from your usual desk, the system grants implicit trust. It only steps up when things look genuinely weird. This reduces the daily friction for legitimate users by probably seventy percent, while actually increasing security posture. Luna: That sounds significantly better. But implementing that requires a huge amount of data collection. Isn’t there a privacy backlash waiting to happen? Lucas: There absolutely is. And this is where the legal and HR teams start sweating. Continuous monitoring of keystrokes or mouse movements can feel invasive. In Europe, under GDPR, this is a minefield. Even in the US, state laws are tightening. Companies have to be transparent about what data is being collected and why. If you don’t explain the value proposition clearly—that this keeps their personal data safe—you’re going to face resistance from the workforce. Luna: So it’s not just a technical problem anymore. It’s a communication problem. You have to sell the safety benefit to the employees, not just the compliance benefit to the board. Lucas: Right. And let’s be honest, most security teams are terrible communicators. They speak in jargon. 'We’re implementing granular policy enforcement.' Nobody cares. What they care about is 'Will I get locked out of my own account before lunch?' If you can’t answer that simply, you haven’t done your job. Luna: I love that. Simple answers for simple questions. Complex problems require simple explanations. Lucas: Let’s look at a concrete example. A major retail chain tried to roll out a new unified login system last year. They mandated a physical security key for every employee. Result? Massive complaints. People lost keys. Keys broke. Remote workers couldn’t ship them fast enough. Sales reps in the field were stuck. They had to pivot within six months to a mobile-based authenticator app. Productivity bounced back immediately. Luna: Because the mobile phone was already in their pocket. They removed the physical dependency entirely. Lucas: Exactly. They aligned the security mechanism with the existing user behavior. That’s the golden rule of modern identity management. Don’t ask users to change their workflow to fit the security model. Adapt the security model to fit the workflow. It’s harder to build, sure. It requires more upfront engineering effort. But the long-term maintenance cost is lower because you’re not fighting human nature. Luna: It’s the difference between forcing someone to walk through a metal detector versus scanning their gait. One stops everyone. The other just flags the odd ones out. Lucas: Perfect analogy. And here’s the kicker for business leaders. When you reduce friction, you also reduce churn. Not just employee churn, but customer churn. If your customers have to jump through hoops to access their own accounts, they’ll leave. B2B or B2C, the expectation for seamless digital experiences is now baseline. Security cannot be an excuse for poor UX. Luna: So security becomes part of the product design, not an add-on layer slapped on at the end. Lucas: It has to be. We’re seeing companies hire 'Security Experience Designers.' Yes, that’s a real job title now. These folks sit between the engineers and the users. Their job is to map out every interaction point and ask, 'Is this necessary? Can we make this smoother?' It’s a radical idea, but it’s becoming essential as threats evolve and user expectations rise. Luna: I’m curious though—does this level of customization scale? Or does it become a nightmare for smaller companies with smaller IT teams? Lucas: That’s the billion-dollar question. For large enterprises, yes, it scales because they have the budget for custom integrations. For SMBs, they’re relying on managed service providers or cloud-native solutions that abstract away the complexity. The good news is that the big players are commoditizing the hard parts. You don’t need to build the behavioral engine yourself; you rent it. The challenge is configuring it right. Luna: Configuring it right meaning understanding your own business risks deeply, rather than just clicking 'next' on the installer. Lucas: Exactly. Off-the-shelf settings are rarely optimal. You have to tune them. And that tuning requires insight. It requires knowing who your critical users are, what systems they touch, and where the actual vulnerabilities lie. Generic policies create generic friction. Tailored policies create tailored security. Luna: So the skill gap isn’t just about coding or networking anymore. It’s about understanding the intersection of psychology, policy, and technology. Lucas: It’s all of those things. And frankly, it’s becoming a strategic advantage. Companies that get this right don’t just sleep better at night. They operate faster. Their employees are happier. Their customers stay longer. Security stops being a cost center and starts being an enabler of velocity. Luna: That’s a powerful reframe. Usually, security is seen as the brake on the car. You’re arguing it should be the steering wheel. Lucas: Or at least, the suspension system. It absorbs the bumps so you can drive faster without falling apart. We’re still a long way from getting there universally, but the trajectory is clear. The era of brute-force security is ending. The era of intelligent, empathetic security is beginning. Luna: And the ones who figure out how to build that empathy into their code first will probably win the next decade. Lucas: I think you’re right. The question for leaders today isn’t just 'Are we secure?' It’s 'How secure can we be without making ourselves impossible to work with?'