"37% of their frontline workers experience an authentication issue in a typical month," Imprivata found — and those interruptions, the company says, are delaying patient care.
Authentication failures and mounting lost hours
Imprivata’s report quantifies how credential and authentication problems translate into lost productivity at the point of care. Organizations estimate that 37% of frontline workers experience an authentication issue in a typical month. Each affected worker is interrupted around 11 times and loses an average of 2.5 hours of working time a month. For an average organization in the survey with around 2,800 frontline workers, that calculates to 32,400 working hours lost annually.
Widespread workarounds — and an accountability gap
Nearly all organizations (95%) have observed frontline workers adopting workarounds to avoid or blunt authentication friction. The most frequently reported behaviors were staying logged in to avoid re-authentication (40%), attempting to bypass multi-factor authentication or other controls (36%), and sharing credentials (33%).
Those responses, the report notes, create an accountability shortfall: only 40% of decision-makers are very confident that frontline access can be attributed to the correct individual. In other words, institutions are seeing routine practices that reduce control effectiveness at the same time they are losing confidence in identity attribution.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAI-assisted impersonation, account-recovery attempts, and service-desk social engineering
Imprivata’s data places the authentication problem alongside a rapid rise in adversary tactics that exploit human and technical weaknesses. Fifty-seven percent of organizations reported confirmed or suspected AI-assisted or deepfake employee impersonation in the past 12 months, and 23% confirmed an incident. That sits alongside 62% of organizations reporting a confirmed or suspected unauthorized account-recovery, password-reset or unlock attempt, and 60% reporting social-engineering attempts targeting the service desk.
The report draws a direct line between those attacker behaviors and workplace workarounds: "These workarounds add risk to environments that attackers are already probing with AI." Reflecting that environment, 48% of frontline organizations are very or extremely concerned about AI-enabled impersonation — the same proportion that are very or extremely concerned about conventional social engineering.
What this means for technologists, healthcare leaders, and frontline workers
- Technologists and security teams: the report’s figures make clear where adversary activity and defensive gaps overlap — 57% reporting AI-assisted impersonation, 62% reporting unauthorized account-recovery attempts, and 60% reporting service-desk social engineering. Those numbers signal the specific vectors to monitor and measure: impersonation driven by AI/deepfakes and attempts to manipulate account-recovery processes.
- Healthcare leaders and procurement: authentication friction is not just a security metric but an operational one. Imprivata’s headline productivity estimate — 2.5 hours lost per affected worker per month and 32,400 hours annually for an average 2,800-person frontline — positions authentication design and vendor choices as factors that affect staffing capacity and patient-facing time.
- Frontline workers and patients: the survey ties authentication problems directly to interruptions in care. Frontline workers who face an average of 11 authentication interruptions a month and routinely adopt workarounds are the proximate actors affected; organizations report those behaviors are linked to delays in patient care.
The Imprivata findings present a straightforward, if stark, calculus: authentication friction is creating measurable operational cost and predictable behavioral responses among frontline staff, while threat activity — including AI-enabled impersonation and targeted service-desk social engineering — is already testing those fragile controls. The data leaves a clear question for healthcare organizations: how to reconcile the need for quick, reliable access at the bedside with the increasing sophistication of attacks that exploit exactly the short-cuts workers adopt.
