A few months ago, I was on-site at a large consumer goods manufacturer. I was there to explore how Zscaler technology could support their factory operations, the kind of day that starts in a meeting room and ends with a walkthrough of the factory floor. And it was on that walkthrough, shown around by one of their team, that something shifted my thinking.
We were watching a maintenance technician at work. He was diagnosing a fault on a production line, moving between machinery, checking readings, speaking with colleagues, trying to pinpoint the source of an issue. Mid-flow, the tablet he was using logged him out. Inactivity timeout.
He needed to sign back in. But this isn't a desk job. His hands were gloved, standard PPE on this part of the floor. He removed the glove, located the device, entered his credentials, re-gloved, and picked up where he left off. I watched it happen again twenty minutes later. And according to the person showing me around, this was entirely normal. Every day. Every shift.
What struck me wasn't the timeout itself. It was the matter-of-factness of it. Nobody flagged it. Nobody complained. The worker just adapted and moved on. And that, I realised, was exactly the problem.
Now, the security rationale behind that inconvenient timeout is completely reasonable. The organisation clearly doesn’t want an unattended device left logged in on a busy factory floor. They’ve put this simple security control in place to protect access, reduce the risk of an unauthorised breach, and ensure there is a level of accountability baked in if something does go wrong. From a governance perspective, everything is working exactly as intended. Great.
However, there is a 'but'… the technician feels annoyed by the need to continuously sign in. With his attention split between equipment, people and processes, and with the clock ticking on an unresolved fault that could halt production, the pressure to keep moving is real. So he adapts. They all do.
Some workers get into the habit of tapping the screen every few minutes to stop the session expiring. Others go further. Credentials get shared between colleagues so that whoever picks up the device next doesn't have to stop and re-authenticate. Devices get modified, lock screens disabled, auto-timeouts adjusted, because someone decided the control was getting in the way of the job. Workers reach for their personal devices instead of the issued device, because it's faster, easier, and already in their pocket. And in some cases, login details end up written on a label stuck to the back of the device itself, visible to anyone who picks it up.
None of these are acts of malice. They're acts of pragmatism, driven by the very real pressure to resolve issues and keep the line moving. A stopped production line costs money by the minute, and no worker wants to be the reason it stopped. The security control is still nominally in place. But the protection it was designed to provide? That's gone. Frustration is present. But it rarely surfaces. Workers don't raise IT tickets about this. They don't escalate. They solve the problem in front of them and move on. And herein lies the problem.
The Invisible Tax
Technology teams focus on security controls, compliance outcomes, audit readiness and on-target deployments. All important measures of success. The challenge is that these metrics don't reveal what the day-to-day experience of using that technology actually feels like.
For staff on the ground, impact is measured by efficiency. Three seconds here. Ten seconds there. One extra login. One additional approval. One more interruption to a task. Viewed in isolation, these time drains are insignificant. But lump them together and you see a clear snowball effect of lost seconds rolling into minutes, repeated across shifts, sites and hundreds of workers. Production doesn't stop for repeated logins and logouts. Output targets still need to be met, so the line can keep moving. Time lost is business lost.
The IT department and the factory floor are measuring different things: neither perspective is wrong. But this difference of opinion does create a disconnect between how tech teams believe work happens and how work really happens.
Manufacturing organisations spend a lot of time preparing for outages, security incidents and operational disruption. Less attention tends to be paid to the small frustrations workers encounter every day, despite the fact that these hurdles can have a huge cumulative impact.
The necessary shift leaders must now make is factoring in the cost of operational friction required to achieve security.
What Good Actually Looks Like
Let’s get back to understanding which benefits workers actually value, and which goals shape the way they work. Output, quality and efficiency are core drivers, with reliability, simplicity, continuity and speed seen as valuable benefits of any technology.
When technology supports factory-floor goals, adoption (in the way it was intended) becomes natural, fewer security workarounds emerge, productivity improves, and security itself becomes easier to sustain. In fact, the best manufacturing technology is the one that fits so naturally into the workflow that workers stop thinking about it altogether. It needn’t be technology that workers actively appreciate. It needs to be technology they barely notice.
What does this mean for the people deploying the technology? Insight into their colleagues’ actual experiences using the technology for the first few months is a first-order priority. For example: how much extra effort does the technology require on the factory worker’s part? What workarounds are emerging, and why?
The technology may very well be the most advanced on the market, but that won’t matter if its controls are designed around ideal operating conditions rather than operational reality. IT’s metric of success must evolve from the traditional “does this pass the security review” test to a place where they can answer this: “can a worker get through a 12-hour shift using this naturally without needing to think about it?”
The strongest sign of success may be that workers stop noticing the technology is there at all. Because if people need workarounds to get their job done, the technology hasn't truly succeeded, no matter how successfully it was deployed.
This blog is the third in a short series looking at how the security challenges facing manufacturing are converging. The first explored why distributed, cellular-connected environments are making it harder for organisations to maintain visibility and control at scale. The second examined how the speed of connected systems is outpacing organisations' ability to respond. This piece brings it to the human layer, because even the most technically sound security architecture will be quietly dismantled by the people it inconveniences, if their operational reality isn't designed for them.
You can read the full series here:
Part 1: From Air Gaps to Always Connected - The Uptime Challenge for Security
Part 2: The Race to Production - Why Connectivity is Becoming a Competitive Risk
