Security upgrades punish low‑risk users

When firms react to breaches by adding user‑facing authentication hoops (QR codes, forced authenticators), ordinary users face large time and usability costs while the organization’s privileged‑access vectors remain unchanged. Those measures can reduce real security (more device‑bound logins, broader attack surface) and raise support costs and distrust. — Calls attention to a common misallocation in cyber responses — visible fixes for optics instead of tightening permissions and monitoring — with implications for regulation, procurement, and product design.