Security nobody can use is not secure

For about fifteen years, you were told to build passwords out of capital letters, numbers, and symbols, and to change them every 90 days. You responded the way any rational person would. Password1! became Password2!.

The rules traced back to an eight-page government document written in 2003 by a NIST manager named Bill Burr. In 2017, by then retired, he told the Wall Street Journal that he regretted much of what he'd written. That same year NIST rewrote its guidance and dropped both the forced changes and the special character requirements.

The rules hadn't made anyone safer. They had annoyed people into choosing worse passwords.

That's the lesson. Security that ignores how people behave doesn't stay secure.

One more shift left

DevSecOps was a real improvement. It moved security from a final checkpoint into the development process itself, which gave us better protection and faster delivery.

But it still grades itself on scans passed and compliance boxes checked. It asks whether the system is secure. It rarely asks whether a person can use the system without wanting to throw the laptop across the room.

So the next shift is to bring customer experience in at the same point. Our partner NuAxis Innovations has a name for it: DevSecCXOps™. It's a mouthful, and it's the right idea.

What it looks like in practice

• Test security steps with real users. Logins, multi-factor prompts, permission requests, and timeouts are features. Test them like features.
• Measure friction alongside vulnerabilities. Track failed logins, password resets, abandoned sign-ups, and help desk tickets caused by security controls.
• Treat workarounds as findings. The sticky note on the monitor, the shared account, the file sent to a personal email: each one is a vulnerability report filed by your users.
• Make the secure path the easy path. If the safe way takes six steps and the unsafe way takes one, you already know which one people will choose.

Friction is a risk

When security is painful, people route around it. When it's smooth, they just use it.

Apple understood this. Unlocking a phone with a glance is strong security that people like using. Nobody has ever taped their face to their monitor.

Trust is the outcome

When customer experience guides the security posture, we build systems people trust and enjoy using. Security stops being merely functional and becomes frictionless.

That's the goal: safety and satisfaction, shipped in the same release.

DevSecCXOps is a trademark of NuAxis Innovations. A shorter version of this article first appeared on LinkedIn. Join the discussion there.