Your frontline workers have a workaround for that MFA prompt

The workaround nobody writes down

Multifactor authentication is meant to tie an account to a person. But in healthcare and manufacturing, where seconds matter and workstations are shared, that prompt is often the thing workers get around first.

A survey of 700 IT and security decision-makers found that 95% had seen such workarounds in the past year ^[1]. Workers stay signed in on shared devices, share credentials or skip authentication steps to avoid delays. The security policy says one thing; the floor does another.

It is like locking the front door and leaving the key under the mat. The lock works, the policy is followed on paper, and the gap between them is something nobody mentions until something goes wrong.

Why it happens

The reason is not laziness. A nurse moving between patients does not have 30 seconds to wait for a code. A factory worker at a shared terminal on the production line has a quota to meet. When the authentication step slows them down, they find a way around it.

That way around might be staying signed in all day, sharing a login with a colleague or asking someone else to unlock the device. From their perspective, it is pragmatic. From a security perspective, it breaks the system.

Access logs stop meaning what they are supposed to mean. An entry that says "user A opened record B at 14:32" might be true, or it might mean user A was signed in but user C was at the keyboard. When an incident is investigated or an auditor asks questions, the log is the first thing questioned.

What the numbers show

The survey, conducted by Censuswide for 1Kosmos, covered organisations in the US and UK across healthcare, manufacturing, retail and finance ^[1]. Nearly all respondents (95%) reported observing authentication workarounds. The pattern was strongest in healthcare and manufacturing, where shared workstations are common and speed is built into the job.

The problem is not new, but it has become harder to ignore. Cybersecurity regulations such as DORA and the Swedish Cybersecurity Act require organisations to document access and protect logs against tampering ^[2][3]. When the logs themselves are based on accounts that multiple people use, the documentation is less solid than it looks.

The access log problem

Access logs are like receipts: nobody looks at them until there is a dispute. But if ten people share one login, the receipt does not say who bought what.

DORA's technical standard on ICT risk management, which applies to financial firms since January 2025, specifically requires logs to be protected against tampering, deletion and unauthorised access ^[2]. The Swedish Cybersecurity Act, in force from January 2026, sets similar requirements for critical sectors, including healthcare ^[3]. An access log that cannot reliably tell you who accessed what does not meet the requirement, no matter how well it is protected.

The missing piece is not the log itself but the step before it: knowing who is actually signed in.

Passwordless as a way out

One answer is passwordless authentication: biometric readers, hardware tokens or mobile-based verification that works in seconds. The 1Kosmos survey found that 68% of organisations were already using passwordless methods, and another 29% were planning to ^[1].

The advantage is speed. A fingerprint or a tap on a phone is faster than typing a password and waiting for a code. When authentication is quick, workers are less likely to work around it.

That still leaves the question of the logs. Even with passwordless authentication, an access log kept by the organisation itself can be questioned, especially if someone with the right access could edit it quietly. That is where a digital witness comes in.

Sealing access logs

Here, the thing to seal is the access log itself, in segments. Every few minutes, a fingerprint of the latest log entries is sent to WitniumChain. The log stays where it is. Only the fingerprint is sealed.

Anyone who needs to check the log later—internal audit, a supervisor, an incident response team—calculates the fingerprint again and compares it with the sealed one. If they match, the log has not changed since it was sealed. Change a single entry and the fingerprints will not match.

It does not replace access control or monitoring, and it does not make a bad log good. But it does mean that when someone questions whether the log was edited after an incident, the answer is checkable.

Your system sends the fingerprint through the REST API, the SDK or the MCP server. The content of the log never leaves your systems. To check, you calculate the fingerprint again. The first 2,000 witnesses a month are free. Read the docs.

What this means for you

If your organisation uses shared workstations in healthcare, manufacturing or similar settings, ask:

• Do your authentication methods work at the speed your frontline workers actually move?
• Can you tell from your access logs who was really signed in, or just which account was used?
• If an auditor or a supervisor asked whether anyone had edited an access log after an incident, could you show that nobody had?

Passwordless authentication closes the gap between policy and practice. Sealing access logs makes them harder to question later. Both are answers to the same problem: the policy works on paper, but the floor has found a workaround.