Reading security friction as a diagnostic signal

Cybernetic Immunity asks what the pattern of security-related acts says about the condition of an organization.

Defense begins with distinction: what to stop, what to allow, when to respond.

Controls encode those distinctions. What people do when they encounter them is not encoded. That is the diagnostic signal: the pattern we measure. An MFA prompt proves nothing on its own. Neither does a blocked transfer, a helpdesk ticket, or a passed scan. What matters is what happens around them.
‍
When does the control appear?
What does the person do with it?
Does the response change when the risk is real?
Do people start routing around it?
Does the organization change the control when they do?

Most audits ask what was done: was the threat model made, was the scan run, was the build signed. That gives a checklist, and a checklist can be ticked by a team that owns its security or by a team going through the motions. From the outside, they look the same. Friction is usually counted as a cost. But low friction can mean a system calibrated well, or one with no defense left to meet. High friction can mean a system meeting a real threat, or one where every commit needs ten approvals while the vulnerabilities stay where they were. The quantity tells you very little. What happens next tells you a great deal.

The diagnostic model comes from immunology, where a symptom is read through the system's response rather than in isolation: the same signal means one thing in a system that reacts and recovers, another in one that has stopped reacting at all. What we read are the acts: who was stopped, who was allowed, who responded, and when, using the action grammar of Human Act Analytics.