Organizational friction is the delay and misalignment that happens when teams have unclear priorities, too much process, or weak coordination. In cyber security, it often shows up as slow approvals, duplicated work, inconsistent ownership, and handoffs that leave gaps between policy and execution. A tool may be available, but if no one knows who decides, who reviews, or who responds, the control fails in practice.
Attackers benefit from this kind of confusion. Friction can slow patching, delay incident response, and let shadow IT or ad hoc workflows bypass security review. Defenders also need to watch for it in AI programs, where unclear governance can create unsafe automation or hidden data exposure. Reducing organizational friction means defining decision rights, simplifying workflows, and aligning technical teams with business goals so security controls work at operational speed.