In this episode of The Agile Software Engineering Deep Dive, Alessandro Guida explores what happens when corporate security is added in layers without enough attention to workflow, usability, recovery, and productivity.

Using the metaphor of painting yourself into a corner, the episode looks at a familiar modern workplace problem: VPNs, tunnels, multi-factor authentication, device compliance, strict password policies, authenticator apps, app PINs, short screen timeouts, and repeated confirmation prompts that may each make sense in isolation, but together can create serious friction for employees.

This is not an episode against security. Quite the opposite.

It is an episode about designing security properly.

The discussion covers why security should be treated as an engineering system with real users, real workflows, measurable performance requirements, failure modes, and recovery paths. It also looks at common traps such as MFA recovery loops, where the system sends the confirmation code to the very phone that has just been lost.

The episode argues that security teams and engineering teams should ask a simple but often forgotten question:

How does the complete workflow actually work for the human being who has to use it?

From use cases and workflow testing to acceptable friction, hardware support, passkeys, biometrics, and better recovery design, this episode is a reminder that good security should not only reduce risk. It should also help people work safely without constantly fighting the system.

Because the most secure system in the world is not very useful if nobody can get their work done.

Support the show

This Podcast is an audio version of the written Agile Software Engineering newsletter. If you want to go deeper, don't forget to subscribe the newsletter too.