Administrative friction is the time, effort, and repeated effort needed to complete routine business tasks such as approvals, account setup, payments, reconciliation, or access changes. In ordinary operations, some friction is useful because it slows risky actions and creates checkpoints. In cyber security, the term matters because attackers often look for places where busy teams will skip steps, reuse passwords, approve requests too quickly, or ignore review processes just to get work done.
Real attacks and defenses both revolve around this idea. Phishing, business email compromise, and invoice fraud often succeed by exploiting the pressure to reduce friction and act fast. Defenders try to lower unnecessary bureaucracy while keeping strong controls, for example by using multi-factor authentication, role-based access, approval workflows, audit logs, and clear ownership of financial actions. The goal is not zero friction; it is the right amount of friction at the right point in the workflow.