Dhruv Markandey

Compliance frameworks like HIPAA and FDA 21 CFR Part 11 rest on one assumption: every access event can be traced to a specific individual. Shared logins on frontline devices quietly break that, producing audit trails that look complete but fail the attribution requirement entirely, breach or no breach. The requirement hasn't changed; digitization has pushed regulated system access onto shared devices, the rule was never stress-tested against. Fixing it means identity infrastructure that attributes access to the person on shift, without slowing frontline work down.

Frontline workers don't bypass authentication because they're careless. They do it because the system makes compliance slower than the job allows. Authentication designed for desk workers fails in shared-device, high-speed environments, and no amount of training changes that. The real cost isn't just breach exposure; it's the operational drag that security teams never measure and operations teams quietly absorb. Fixing this means designing authentication that is fast and secure by default, built around the frontline environment rather than retrofitted onto it.