Cost and friction is the expense, delay, or operational burden that a process step adds to work. In cyber security, friction is often deliberate: a login prompt, approval check, rate limit, or network segmentation step makes an action slower or harder to abuse. The goal is not to block every action, but to raise the effort needed for misuse while keeping legitimate work possible.
This matters because attackers also optimize for low friction. They prefer paths that automate well, bypass review, reuse stolen credentials, or avoid noisy controls. Defenders use cost and friction strategically by adding MFA, just-in-time access, secure defaults, and detection steps that force attackers to spend more time, money, and attention. But too much friction can backfire if users invent workarounds, disable protections, or ignore alerts. Good security design balances protection with usability, making harmful actions costly and routine work efficient.