The Anatomy of a Monday Morning Breakpoint
The sun-faded parking pass dangling from the rearview mirror of a Honda Civic is not usually considered a piece of cybersecurity infrastructure. It is a rectangle of brittle plastic, curled at the edges from three summers of unrelenting heat, and it grants Gary the right to leave his car in a concrete structure three blocks away from the office of the regional food bank association.
But today, that parking pass represents the exact point where a thousand-dollar security policy meets a ten-cent reality.
Gary is the office manager. He is the person who knows which donor likes their thank-you notes handwritten and which fridge in the warehouse has the temperamental door seal. He is currently standing at his desk, the board packet for the quarterly meeting open on his screen. It is on a Monday. The packet is due in the Executive Director’s inbox by . Gary just needs to log into the member portal to pull the final donation metrics, but the screen is demanding a six-digit code.
The code is on his phone. The phone is sitting in the cup holder of the Honda Civic, three blocks away, because Gary was carrying three bags of groceries for the staff lunch and forgot he’d tucked the device into the center console to charge.
The Friction Tax
The cost of security is measured in more than dollars. It is measured in the “three-block walk” that busy people cannot afford to take.
In that moment, the security of the organization is not protected by the encryption of the authenticator app. It is threatened by the three-block walk. Gary doesn’t have fifteen minutes to spare. He has a deadline that feels like a physical weight on his chest. He does what any rational human being under pressure does: he looks for the path of least resistance. He calls Priyanka.
Priyanka is a volunteer IT consultant who set up the two-factor authentication (2FA) rollout because the board attended a seminar on ransomware. She is a saint of patience, but she has heard Gary’s voice three times this month.
“Priyanka, I’m so sorry. My phone is in the car. I have the board packet due in forty-five minutes. Can you just… turn that thing off? Just for this morning? I’ll turn it back on as soon as I send the email.”
– Gary, Office Manager
Priyanka sighs. She knows that “just for this morning” is a lie, not because Gary is a liar, but because Gary is busy. She clicks a few buttons in the administrative backend and disables the requirement for his account. Gary logs in, the packet gets sent, and the board is happy. In June, later, Priyanka will be doing a routine audit and realize that Gary’s 2FA is still turned off. It was never switched back on. It never had a chance to be.
The Priyanka Paradox
We talk about “staff resistance” to security as if it’s a character flaw or a lack of intelligence. We treat it like an attitude problem that can be solved with a more colorful slide deck or a sterner memo from the CEO. But if you look at the “Priyanka Paradox,” you see something else entirely.
The failure doesn’t belong to Gary, and it doesn’t even really belong to Priyanka. It belongs to a system that was designed for a perfect human who never leaves their phone in a cup holder and never works under a deadline.
Earlier this morning, I had to kill a spider with a shoe. It was a large, hairy thing that had taken up residence right above my keyboard. My response was visceral and disproportionate-I grabbed a heavy-soled boot and leveled the area. It was blunt force applied to a problem that required precision.
That is how most organizations approach security. They see a risk (the spider) and they swing the heaviest shoe they can find (mandatory, single-method 2FA) without considering that they might also be smashing the desk they need to work on.
Blunt, rigid, and causes collateral damage to workflow.
Flexible, layered, and designed for human error.
The Indifference of Math
To understand why Gary’s phone being in the car breaks the system, you have to understand how the handshake actually happens. A Time-based One-Time Password (TOTP) is a beautiful bit of math. It relies on a “shared secret”-a string of numbers and letters that only the server and your phone know.
Every thirty seconds, your phone takes the current time, combines it with that secret, and runs it through a mathematical blender called an HMAC-SHA1 hash. The result is those six digits you see on the screen.
The server does the exact same math at the exact same time. If your numbers match the server’s numbers, the door opens. It is a proof of possession. It says, “I am the person who holds the device that holds the secret.”
But the math is indifferent to the fact that the device is in a parking garage. The math doesn’t care about the board packet. The math has no legs. When we impose a single method of proof on every role in an organization, we are creating a system that is brittle. It doesn’t bend, so it snaps. And when it snaps, we create “exceptions.”
Lessons from the Prison Library
Nora D.R., a woman I know who works as a librarian in a medium-security prison, once told me that the most dangerous part of any facility isn’t the locks; it’s the keys. If a guard loses a key, the entire wing goes into a state of emergency.
But the library is different. In the library, there are layers. There are physical keys, but there are also logbooks, visual identifications, and internal protocols. Nora understands that in a high-stakes environment, a single point of failure is a trap. If there is only one way to prove who you are, and that way is blocked, you will eventually find a way to circumvent the door entirely.
In most WordPress environments, the default “door” is the wp-login.php page. It’s generic, it’s cold, and it’s often the first thing a bot tries to break. When an organization decides to get serious, they bolt 2FA onto that generic door. But they don’t change the door itself, and they don’t give Gary a spare key.
The Illusion of 100% Adoption
This is where the two-tier system is born. On paper, the organization has a 100% 2FA adoption rate. The board is told the “perimeter is secure.” But in practice, the busiest people-the ones with the most access and the tightest deadlines-are the ones living in the “exception” zone.
The volunteer carries the secret of the disabled security, the staff member carries the guilt of the workaround, and the next policy is designed with even less trust because “people just won’t comply.” We avoid redesigning the work by blaming the individual. We say “Gary should have been more careful,” instead of asking “Why was the authenticator app the only way for Gary to prove he is Gary?”
If Priyanka had been using a tool like
the conversation might have been different. Instead of a binary choice between “Secure” and “Broken,” there could have been a spectrum of trust.
Gary could have had a passkey on his laptop-a biometric check that doesn’t require his phone at all. He could have had a set of one-time recovery codes tucked into his desk drawer for exactly this “phone in the car” scenario. He could have received a magic link via his work email, which he was already logged into.
Every security measure carries a cost in time and cognitive load. When that cost exceeds the perceived value of the task at hand, the human brain will bypass the measure. It is as certain as gravity.
I think about that spider often now. I could have moved it. I could have used a glass and a piece of paper. But I was in a hurry, and the shoe was there. Most IT rollouts are “shoe” solutions. They are intended to solve the problem quickly and decisively, but they leave a mess behind. They leave people like Priyanka managing a growing list of “temporary” exceptions that never expire.
The Culture of the Office
The regional food bank association eventually had a minor scare-not a breach, but a close call where a former employee’s account was still active. When the board looked at the logs, they were horrified to find that half the senior staff hadn’t used 2FA in months.
They blamed the “culture of the office.” They ordered more training. They didn’t look at the parking garage three blocks away. They didn’t look at the deadlines.
True security isn’t found in the strength of the lock, but in the reliability of the recovery. If you give a worker a tool that only works when their life is perfect, you have given them a tool that will fail them exactly when they need it most-when they are stressed, when they are late, and when their phone is in the cup holder of a car in a hot parking garage.
We need to stop building digital fortresses that require us to leave our humanity at the gate. We need systems that recognize that “Gary” is a person who forgets things, and “Priyanka” is a person who wants to help, and “Security” is something that should happen while we work, not instead of it.
The most sophisticated encryption in the world is no match for a sun-faded parking pass and a three-block walk.
Until we design for the Monday morning at , we aren’t actually building security. We’re just building a very expensive way to make our coworkers feel like they’re failing, right up until the moment they decide to break the system just so they can do their jobs.
Gary got the packet out. The board was happy. The “thing” stayed off. And the spider? The spider is gone, but the mark on the floor remains. We have to decide if we want to keep swinging shoes or if we’re finally ready to build a better door.