Avery Pennarun, CEO of Tailscale. He writes about secure networking, infrastructure, and building systems that make technology simpler.getty​I've been in the same security conversation many times: Someone brings up phishing, someone else pulls up the clickthrough rate from the last simulation, and we all start brainstorming ways to reduce the number of clicks. More training. Bigger warnings. Scarier banners. Eventually, someone says, with total sincerity, that we just need people to be more careful, and the conversation's over.The problem is that we treat clicking links as the disease when it's really just a symptom. Links themselves aren't dangerous. They're pointers. The damage happens afterwards when something else fails: a password gets entered into the wrong page and works, a stolen credential can be replayed from anywhere, MFA quietly downgrades to something weaker because "fallbacks are important," a session token becomes the real prize. If clicking a link can take down your company, the link wasn't the problem. Weak authentication was.Honestly, the "don't click links" campaign was always doomed. People are going to click links because the internet runs on links. Email and the web are basically protocols for delivering links without looking at them first. Slack delivers even more links faster. Browsers are designed to make clicking instant and safe. This is how we built the entire thing.Training is competing against reality, and reality tends to win. Meanwhile, attackers can iterate faster than training materials, and they only need a single person to have a rushed, distracted moment. Everyone else is just trying to do their job without another mandatory slideshow that teaches them to be suspicious of their coworkers interrupting them.What makes this especially frustrating is that we already have the tools we need to make phishing dramatically less effective: hardware-backed keychains, passkeys, device-bound tokens, FIDO/WebAuthn. When you deploy phishing-resistant authentication, a whole category of attacks goes away entirely. Fake login pages won't get anything useful. Stolen passwords won't matter. The attacker can still try, but the system stops rewarding them.The best part is that, done right, good authentication can be one of those rare security improvements that makes users less miserable instead of more. It reduces the number of moments where you have to stop what you're doing and prove you're you in some elaborate ritual. The Better Goal: Making Logins So Rare That They're SuspiciousHere's a framing I wish more companies would aim for: Wouldn't it be cool if "logging in" was basically a zero-click event? Not "no authentication," obviously, but just authentication that happens continuously and quietly using strong, phishing-resistant signals so that humans almost never see a classic "enter your password" moment.If you can get close to that world, something psychologically useful happens: The login prompt itself becomes a red flag. It's the opposite of "two-factor fatigue." Right now, we've normalized incessant reauthorization prompts and MFA nags so that when an attacker shows up with one more, it blends into the background noise we created. We've trained people that surprise authentication popups are normal. However, if the steady-state experience was opening up the laptop and everything just working, then a sudden "please sign in" screen would be a discontinuity. It's weird. That gives you a much simpler user message than "learn to detect phishing." Try: If you see a login screen you weren't expecting, stop. Humans aren't great at spotting subtle fakes, but we're pretty good at noticing why we're being asked something at a particular moment in time—as long as we haven't trained ourselves to ignore it.Why don’t we do this everywhere?We've been aiming at the wrong layer. We keep trying to protect actions—clicks, logins, sessions—instead of anchoring everything to identity. Actions are noisy. They're contextual, and they change all the time. Identity, by contrast, is remarkably stable.Who you are doesn't change minute to minute. Your device doesn't change minute to minute. Your relationship to an organization doesn't change every time you open a browser tab. We already know this, which is why modern systems are full of strong identity signals: the Okta or Entra provisioning that defines who you are at work, the Apple or Google identity bound to your phone, the hardware-backed keys that prove a device really is that device. We just haven't been consistently treating those signals as the foundation they should be.Once you do, a lot of security complexity evaporates. If access to the network itself is gated on strong identity—not a password typed into a page but real, device-backed proof of who you are—then the question of whether this person should be allowed to do this stops being something you relitigate on every click. You already answered it. You let them onto the network. From there, policy decides what they can see, reach or use.In that world, logins stop being a centerpiece. If you've confirmed who someone is well enough to grant them access to the network, then fine-grained rules and policy define what they're allowed to do now that they're in. You don't become any more in by entering your password one more time. Authentication fades into the background, where it belongs. Authorization becomes explicit, auditable and boring—and boring is good.This is also why the idea of "zero-click" logins isn't as radical as it sounds. It's about moving security earlier, anchoring it to identity and then letting everything else flow from that. When identity is strong and continuous, surprise login prompts become weird, and people notice weird.We don't do this everywhere yet because it requires a shift in how we think about security. It means trusting identity systems enough to build on them. It means treating network access as a first-class policy decision, not just a plumbing detail. It means letting go of the comforting illusion that we can train people to never make mistakes.However, this shift is already quietly happening in the systems that work best. Start from identity, tie access to that identity, and let policy do the rest.Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?