A friction signal is evidence that a user is struggling to complete a task. In security telemetry, it can show up as repeat login attempts, abandoned sessions, repeated password resets, back-and-forth navigation, or rapid retries after an error. These patterns often come from confusion, broken workflows, or a control that is too hard to use.
Friction signals matter because they help defenders tell the difference between normal use and abuse. A spike in retries may reveal an account takeover attempt, brute-force login, MFA fatigue, or a phishing page that keeps sending victims in circles. In fraud and IAM monitoring, friction can also show where a security step is causing unnecessary drop-off, which helps teams improve both usability and protection. The key is to read friction alongside context, not as a standalone verdict.