A nurse on a ward, a technician on a production line and a picker in a warehouse share a problem most office workers never meet: the computer in front of them is not theirs. A survey published in October 2026 by the FIDO Alliance and Imprivata puts a number on what that costs. The average organization in the study loses 32,400 working hours a year to authentication interruptions, and each worker who hits them loses about 30 hours.
What the survey measured
Sapio Research questioned 700 IT and security decision-makers in the US, UK, France and Germany in August 2026, all responsible for authentication of frontline staff. 325 came from healthcare and 184 from manufacturing. The average frontline workforce in the sample is about 2,800 people. The report, Frontline Friction: The State of Authentication for Frontline Workers, is published on the FIDO Alliance website, where the full PDF is free to download.
Two caveats. The figures are decision-makers' estimates, not stopwatch measurements, and the time-lost numbers are built from the midpoints of banded answers. Imprivata, a co-sponsor, sells shared-workstation access software. The report also counts only disruptive incidents, so routine login time comes on top.
Five problems behind the numbers
1. Shared devices are the norm, and they break personal login
83% of organizations use shared workstations or devices, and 96% of those report authentication challenges. In half of them, most or nearly all frontline workers share devices; Germany leads at 91%. The hardest parts, by the respondents' account: keeping an accurate record of who accessed what (47%), consistent authentication across device types (45%) and fast, secure user switching (43%).
2. Friction turns into workarounds, and workarounds into risk
95% saw workarounds in the past year. The most common: staying logged in (40%), trying to bypass MFA (36%), sharing credentials (33%), reusing passwords (32%) and sharing badges or tokens (32%). 61% still run shared or generic accounts to some extent. In healthcare, only 36% of respondents are very confident that each access is attributed to the right, verified person.
3. The login was not designed for gloves
The three most-cited challenges tie at 27% each: switching devices, switching users on a shared device, and authenticating while wearing gloves or PPE. Affected workers are interrupted about 11 times a month, for about 14 minutes each time. In healthcare, 40% say authentication delays frontline work, patient care included.
4. Attackers have found the service desk
62% saw a confirmed or suspected unauthorized account-recovery, password-reset or unlock attempt in the past twelve months. 60% saw social engineering aimed at the service desk, and 57% saw suspected or confirmed AI-assisted or deepfake impersonation. No single recovery check is used by a majority: employee ID or badge (41%), email (40%), SMS (34%).
5. Half-finished passwordless is worse than either end
99% of organizations using passwordless methods for frontline staff report a benefit. But 67% are still password-based or inconsistent, and 45% of passkey users keep a password alongside. Organizations mid-transition see twice the credential sharing of passwordless-led ones (44% vs 22%) and more than twice the session borrowing (36% vs 15%). Phishable passwordless methods, such as one-time codes and push approvals, do worse than average on both interruptions and recovery attacks. Shared-device environments are the second-biggest barrier to going further (25%).
How the Crayonic Badge answers them
The Crayonic Badge is a security-first wearable: a FIDO2 hardware wallet with a secure element and a fingerprint sensor, worn by one person and carrying only that person's credentials. Each problem above maps to a design decision.
Shared device, personal identity. The credential lives on the person, not the PC. A Crayonic Bridge at the workstation provides presence-based touchless login and logout: the clinician walks up wearing the Badge and is signed in, walks away and the session locks. Where only an NFC reader is installed, the Badge is tapped like a card. Every action carries one name in the audit trail.
Nothing left to work around. When the secure path is the fastest one, there is no reason to stay logged in, share a password or borrow a colleague's session. Locking on walk-away removes the unattended open session that 24% name as a top concern.
Gloves, masks, no phone. The wearer verifies once by PIN or fingerprint at the start of the shift. After that, on-body detection and continuous motion monitoring keep the Badge unlocked while it is worn, so later logins need no touch at all. If it leaves the body, the fingerprint is asked for again. That replaces the repeated MFA prompts (23%) and frequent reauthentication (23%) the survey lists.
Phishing-resistant by construction. FIDO2 credentials are bound to the service that created them and never leave the secure element, so there is no code to read out to a caller and no push to approve for a convincing voice. Credentials are issued to a named person through Crayonic Credential Manager, so re-issuance can follow the same verified registration as the first issue rather than a phone call to the service desk.
One method, end to end. The Badge also carries X.509 certificates for systems built around smartcards, and Crayonic Gateway extends single sign-on to applications. That lets an organization retire the password at shared workstations instead of running it alongside passkeys, the mixed state the survey links to the most workarounds.
The Badge is FIDO2-certified, with FIDO Level 2 certification in progress, and is manufactured in the EU.
What it could be worth
The survey reports hours, not euros. Combining its averages with Eurostat's 2025 average hourly labor cost of €34.9 for the EU (€47.9 in the Netherlands) gives a rough estimate for a typical organization in the sample:
Hours lost today: 32,400 a year, equal to about 20 full-time employees at 1,600 working hours each.
Value of that time: about €1.13 million a year at the EU average labor cost, or €1.55 million at Dutch rates.
Share recoverable: we model 50% to 80%. Eight of the nine most-cited challenges are login, user-switching, reauthentication and credential problems the Badge addresses; connectivity failures (25%) are not. For comparison, Alder Hey Hospital cut login time from 105 to 10 seconds, and a 55-hospital study measured a 60.5% fall in desktop login time (details here).
Recovered value: €565,000 to €905,000 a year per organization, or about €200 to €320 per frontline worker per year across the whole workforce.
That last figure is the break-even line. A full rollout whose all-in cost per worker (Badge, a share of the Bridges, software and deployment) stays below €200 to €320 a year pays for itself within twelve months on productivity alone. Rolled out first to the 37% of workers who hit problems each month, the recovered value rises to €520 to €840 per worker equipped.
To run the numbers for your own organization, change the inputs in the calculator below. The defaults are the survey averages.
Frontline friction ROI calculator
Defaults are the survey averages and the EU average labor cost. Change any value to match your organization.
Estimate only. Counts productivity alone; excludes routine login time, service desk savings and reduced breach risk. FTE assumes 1,600 working hours a year. The survey's 32,400-hour average is built from banded answers, so its default inputs here give a slightly lower total.
The estimate leaves out three things, each of which pushes the return higher: routine login seconds that never become an "interruption", fewer resets for a service desk that 37% say is busier because of authentication, and lower exposure to the recovery and impersonation attacks that 62% have already seen. In healthcare that last item weighs most: IBM's 2025 Cost of a Data Breach study put the average healthcare breach at $7.42 million, the highest of any industry.
The takeaway
The report's own recommendations read like a specification: phishing-resistant credentials wherever frontline work happens, fast and consistent access across devices, every action tied to an individual, secure handovers on shared devices, a login designed for gloves and constant movement, and no long period of passwords and passwordless running side by side. A credential the person wears, which signs them in when they arrive and locks when they leave, answers nearly all of them. The return comes from the same place as the security: when the secure login is the fastest one, staff stop working around it.
Source: FIDO Alliance and Imprivata, Frontline Friction: The State of Authentication for Frontline Workers, October 2026. Research by Sapio Research, August 2026, n=700.
