Constructive friction is a deliberate small hurdle in a workflow that slows action just enough to trigger review, verification, or a second thought. In cyber security, it is used to reduce mistakes and make risky actions harder to do accidentally, without blocking normal work entirely.
Examples include confirmation prompts before sending sensitive data, step-up authentication before high-impact changes, delays before deleting accounts or rotating secrets, and requiring two-person approval for administrative actions. These controls matter because many security failures come from speed, autopilot, or over-trust in a tool’s output. By adding a little friction, defenders can catch phishing attempts, prevent accidental data exposure, and make it harder for an attacker to automate abuse once a session is compromised. Good constructive friction is noticeable but not so heavy that users bypass it; the goal is to support judgment, not punish it.