Friction reduction is the removal of delays, prompts, or manual steps that make a process easier to complete. In cybersecurity, it is a double-edged concept: defenders use it to help users follow safe practices, while attackers use it to make malicious actions feel effortless. A login flow with single sign-on or passwordless authentication reduces user burden; a phishing kit that auto-fills forms and routes victims through fake checks reduces the attacker’s operational burden.
It matters because people and systems often fail at the points that feel slow, confusing, or repetitive. Security teams try to lower safe friction with clear workflows, automated detection, and fast approvals, so users do not bypass controls. Attackers do the same in reverse by streamlining malware delivery, social engineering, and account takeover. The practical lesson is that good security removes unnecessary friction without removing verification, review, or accountability.