Frontline Mobility Edge
Frontline Mobility Edge takes a look at mobility in the enterprise, focusing on workforce devices, business applications and the technology behind them.
Frontline Mobility Edge
NEW Survey Results Show How to Use Biometrics to Improve Retail Experiences
On this episode of the Frontline Mobility Edge, BlueFletch COO Brett Cooper and CRO Lee DeHihns discuss the latest survey results we uncovered firsthand from 300 retail employees. The findings are especially illuminating for retailers and show how they can use biometrics to make the retail experience better for both employees and customers.
Book a demo with BlueFletch: https://bluefletch.com/book-a-demo/
Watch on YouTube: https://www.youtube.com/watch?v=_4Iz-uk4R90
Learn more about BlueFletch: https://bluefletch.com/
I'm Brett Cooper and this is the Frontline Mobility Edge where we discuss the latest in mobile device technologies and how they're shaping the frontline landscape business. Thank you for joining us. Let's get started. Hello, welcome to another episode of the Blue Fletch Frontline Mobility Edge podcast. I'm Brett Cooper here joined with Lee Deinz today. And we're going to be talking about a survey that we had commissioned with a number of frontline retail associates in North America. The survey was looking at biometric preferences, and it went back a couple of years ago, specific to uh Lee Lee could probably expound this. We rolled out a biometric, was it 2018, 2019, and we got a lot of feedback specifically from legal and HR that employees were not comfortable with biometrics. And I think it got uh we had a lot of friction at that point in time. Um, since then, biometrics have become a lot more commonplace. Uh, and we'll talk about that just as a result of the some of the data from the survey. But I think that the big finding that we came, and this is seven years later, is there is a there's not so much of a pushback on biometrics now for employees, but more of a demand. So there's a lot of folks that actually want to use biometrics as opposed to having to type in usernames and passwords in their shifts. And we'll we'll get into this as we cover some of the results from the survey. But I guess Lee, that's it's the the big takeaway I got out of the results is that's it's much different now than it was seven years ago. Is it the same for you?
SPEAKER_00:Yeah, definitely. And um, I know a lot of times now with the prospective customers that I'm talking to, more and more biometrics is part of the conversation that they're asking about to see if we have those capabilities.
SPEAKER_01:Yeah, so I think that we'll start out with just framing this a bit and the the terminology that we came up with as we were trying to write about this or just framing it up was the the last 10 feet, which is where authentication happens. And I I guess Lee, as as we describe this, how do you think about it or how do you articulate this to clients and folks you're talking with?
SPEAKER_00:Sure. So the last 10 feet would be in let's use the example of a retail associate um in a store. It's so a typical frontline shift, they're going to be clocking in on a shared time clock kiosk, you know, in the back or front of the store, logging into a POS terminal to start completing transactions, maybe grabbing a hand a handheld device to either do a cycle count or fulfill a buy-online pickup and store order, maybe use a tablet for some sort of clientele or assisted selling, like in a department that requires an associate to be part of that sell, like in flooring, for example, or something like that. And then also maybe they might end their shift on a back office PC scheduling vacation or doing training. Uh, so throughout the course of the day, they're moving all over the place, interacting with four, maybe five different device form factors. And they're spending a lot of time logging into those devices. And that last 10 feet of that interaction is what we're talking about. Isn't there's the organizational job that they have to do, but then there's an actual physical interaction with these devices that they have to work with. And so each of those tasks they're doing, each context is a login event or a login switch or something like that.
SPEAKER_01:Yeah, I always think about the either there's all these systems that are back in a data center somewhere with actual real work happens and that few feet from the time the employee is getting a device or work or you know, showing a device to a customer or showing something. And the the the way we phrase this coming out of that is that with that login friction or with any login friction, there is a hidden tax. Um, and that hidden tax, it may not seem like a lot, but as it starts to add up, it gets really, really expensive. And I think the first one of the first questions that was in the survey was asking frontline employees what they do. When I say frontline employees, the survey was specific to people that are on the floor. I think anybody who works in a back office or was working in an HQ got disqualified for the survey. You had to be an employee that is either customer-facing in receiving in the front end and doing things on the floor. But so on this, I think one of the next areas that as we talk about all these authentications that are happening, there is a hidden friction. I call it hidden tax that it adds up for the employees, adds up for the companies to a lot of money. Um, so as part of the survey, one of the things we asked was how many times employees log in. And um the stats, the one that stood out to me is the well, uh, more than a quarter of the employees logged in more than 15 times a day. So if you assume those employees are doing username password, it is a definite burden on them. Uh, and then 66% of employees log in to uh one of their electronic systems more than five times a day. So the average is definitely higher. I think we talk about uh 4.2 to six logins a day. And when we look at it some of the numbers from Blue Fletch, and it's as you go talk to these retail associates, it's definitely increased over the last five or six years based on this the survey from uh from the latter half of 2025.
SPEAKER_00:Um, and I think the number of apps is only increasing too. Um, I talked to a customer yesterday that has more than 20 applications that their associates are interacting with on those devices.
SPEAKER_01:Yeah, so there's a lot more, you know, it is good for employees to have this because they're not having to walk back to an office and do things, but it does create a burden if you don't reduce the friction for employees to use these uh these applications. And I think the next thing I had, this is actually surprised to me. The the part of the one of the questions was how long it takes employees to log in. And 36 uh percent said less than 15 seconds. 37 were in the 15 to 30 second range, and uh the the rest were over 30 seconds. And this was surprising to me because I know we ran a it was actually a contest to see how fast people could log in with a a full uh fully qualified name and eight-digit password. And I think the average was around 41 or 42 seconds. Yeah, and I there definitely were some Gen Z folks that came in under 20 seconds. Uh so this stat surprised me a bit, but uh as I dug into and dug into some of the comments, a lot of people are using a uh new alphanumeric uh you know, like POS code as their login and then are using a pin to get in. So the less than 15 seconds for a third of the respondents made sense. But even at that, the you know, you're taking the average of of those numbers and it can add up very, very quickly.
SPEAKER_00:Yeah, and it's still at that point, 73% of the employees are taking more than 15 seconds per login. And so if they're doing that more than five times a day and up to 15 times a day, that's an incredible amount of time.
SPEAKER_01:Yeah, and for certain roles, especially like high security, you know, if you're a POS where you're doing overrides, every time you have one of those contact switches that Lee you talked about earlier, you're having to log back in. So it definitely increases those numbers for certain employees.
SPEAKER_00:Yeah, for sure. You know, and that 15 seconds doesn't sound like a lot, but we'll break this out a little bit. But even if you think about it just from store experience from a customer point of view, if you're in line and there's 30 seconds where you're just standing there and nothing's happening, that's gonna create a lot of frustration. Um, and you know, if you're trying to get a question asked or answered with an assisted sale and you have to wait 30 seconds, that's also very frustrating. You're like, I just want to know about these headphones. And uh, if you have to wait, that's gonna, that's gonna decrease the wallet share too of of each customer. So there's a lot of costs outside of just the labor side of it.
SPEAKER_01:Yeah, I can there are so many times where I've been to there's a local retailer I go to a lot. And if you have a return, uh, I the number of times a lady's like, sorry, the computer's really slow today when she's like logging in. It's it's just it's it definitely made me think of this this stat as uh as I read this. And I guess from a numbers perspective, lead you want to talk about at scale. I think that the number we use, it's a benchmark is a 10,000 employee retailer. So 10,000 employees doing these logins of you know, five plus and you know, more than more than 30 seconds. You want to talk a bit about what that maths out to?
SPEAKER_00:Yeah, and I you know, when we saw these numbers, it it blew me away. Like I knew when you're like, hey, 10,000 people, 15 seconds, that's a lot of time. But when you actually math it out, if you have a 10,000 employee retailer, slow logins are going to consume over the course of every day 833 hours. And just to quantify 833 hours, that's like five months. So five months of one person working.
SPEAKER_01:An employee work three hours a week.
SPEAKER_00:It it adds up to six point two six point two million dollars annually in just spending time logging in. So that's money that's just walking out the door with nothing to show for it. Um, another model that used even more conservative assumptions, we found that it was about 80,073 hours lost per year on just logins. So it's a crazy amount of time that we're talking about here. Um, so if you can reduce that, you're going to have a huge amount of return on investment from the perspective of if you spend, let's say, 450 to$500,000 on implementing biometrics, you're going to be able to get a return on investment there of you know eight, nine hundred percent on that investment. So it's definitely worth it to spend that kind of money. Um, you'll be able to save about four and a half million dollars a year.
SPEAKER_01:Yeah, that's it's yeah, 10x 10x is a lot. You know, eight eight to 10x is a lot in that. And that's yeah, between four and six million a year in savings for 10,000. But there is there is some caveats there, and we'll talk about that in a bit where we just some of the best practices we learn working with clients on these implementations, and we'll get into that after after we get through some more of these uh these survey results. Um the next section of the survey, this is a funny one because I as I read this, I just made me think of a uh a story I had where um and I I think we were asking people about things like the the satisfaction are you satisfied with the current login process you have? And the you know, the number of people that responded, they were satisfied or somewhat satisfied was was pretty high. It was like 90 percent. And it made me think of the story where I went to a retailer once for uh we were doing some scoping and went and talked to one of the guys that did uh buy online picking in the store. So he, you know, I was kind of shadowing this guy, asked him, you know, how do you like the system? He's like, ah, system's great, I love it. This is uh it's pretty awesome. So the guy logs into the app, goes and picks his first item, uh, puts it in a package, uh, puts like a pick ticket on it, and then puts it in the locker area where they did the the click and collect or the bopus picks. Um, went back, opened up his device again, logged in, uh picked an item, and I proceeded to see him do this four times every single time he logged in. I I asked the guy, like, how many times do you log in a day? He's like, uh, you know, like 40 or 50 times. And I was like, he had said that like he liked the process and he was super happy with it. So I think there's a there's this thing of uh satisfied doesn't mean happy, or you know, there's a yeah, people just get used to it and this is just the way it is.
SPEAKER_00:Yeah, exactly. Like acceptance is different than happiness, right? Um, but I think when you drill into those numbers, 90% say they are satisfied. But when you look at the things that are happening, you know, the some of the numbers we got back were 35% of the people forget their passwords and pins. 30% of the people say that logging in takes too long. Um, a quarter of the people experience account lockouts because they've forgotten their passwords and are trying over and over again. Um, 20% of the people say that their passwords and pins are too complex so they can't remember them. So when you can't remember a password, you start doing things like writing them down.
SPEAKER_01:Um I I think the the account lockout one is an interesting one too, because that that cost is not just the the time of the employee typing in multiple times. If if they type it in three times, it gets locked. They have to go to the back, pick up a phone, go to the help desk, and then you have that employee off the floor for 10 minutes, and you're spending budget on your IT side of somebody in your support team having to reset their password. So it's that is actually a very, very expensive transaction right there. I think that I don't remember what it was, but I think it was like$70 every time somebody gets locked out, which you have if 24% of people are are uh you know unhappy about frequent lockouts, it is uh that sounds like an another expensive hidden cost.
SPEAKER_00:Yeah, if it's a quarter of your 10,000 person workforce, so that's 2,500 people times$70. And then that's only if they locked out of their account once.
SPEAKER_01:Yeah, if one once a year. And it's you know, I'm assuming most organizations have a 90-day password policy. So probably uh take that number times four, and you're probably having a about 10,000 of those$70 events a year. Yeah. So it gets up there, it gets up there fast. Yeah, it's another$700,000 that's out there for those guys. Um, but yeah, I think the the one thing, you know, when you see the 90% are satisfied, and then you see those metrics of um, you know, things that people are frustrated about, it it goes back exactly to what you said. Like the, you know, like being satisfied doesn't mean people like it.
SPEAKER_00:Yeah, exactly. And it's you know, when you look at those numbers, they're a little like that 90% number is a little bit misleading when we drill into what we just discussed. And you know, when you talk to these people about their specific processes around remembering and typing these passwords, dealing with logouts and what that means and interruptions for their workflow. Um this isn't like a work culture problem. It's a really how you've tooled your workforce and the the equipment you've given them to complete their jobs and their tasks just aren't working.
SPEAKER_01:Yeah, which which gets us to some of the biometric questions that we had in the survey. And um, I think the first one is you know, we wanted to get visibility into you know, for for employees, how comfortable are they just with technology in general? And to get a baseline of that, we looked at, you know, for the survey, what is the different percentage of people across age groups? I think that the first thing of the survey, 61% were had worked in retail for more than five years. So that's they've they've been in retail, they've been around, they've been a lot of times at more than one company. Um, and then the age cohorts, the you know, the the middle, I'm gonna call it like the 35 to 50 was the biggest cohort, um, followed very closely by the 25 to 30. And yeah, the 35 to 50 was was a bigger group. So I think the majority of respondents were in that 25 to 50 range, and then there was a uh a decent number in that the 50 plus range uh that are were well represented in the survey as well. So it's age range was pretty wide across this. Um, and then the comfort level of technology across all those age ranges, um, I think we had it was something like 92% were somewhat comfortable or uh highly comfortable technology. And so that's you know, it's pretty um, you know, everybody, if you look around, everybody has a cell phone, everybody's used to using different types of technology, which is sort of leads to some of the next points. But it's there's a lot of people out there that will say, Oh, we can't roll out this because our employees might not like it, but they're typically more savvy with tech than you realize.
SPEAKER_00:Yeah, I think the employees are they want this and they're waiting for you to do it. Um, because it's they're looking for that personal device experience in their professional life. And you know, when we looked at these stats, I remember when we did this survey, Brett. I personally was surprised by the average tenure of people who had worked in retail. So if it's more than five years and these the largest group is 35 to 50, these are seasoned professionals that know what they're doing. This isn't the kind of thing where they're working for 60 days um when they're back from college or something like that. Um, so it's this is a group of people that when they say they want something and they say they know how to use it, I think we can trust that that that's a true statement.
SPEAKER_01:Yeah, definitely. Um and the next thing we we got feedback on on the survey was just the the familiarity with biometrics. And when we talk about biometrics, there's a couple different flavors, but it's you fingerprints and and face are probably the two most common. And that's been driven by Apple and Google over the last 10 years, actually 15 years now. I think uh Apple introduced the fingerprint reader, it was a 2010, and then it was quickly followed by by uh Google and the Android workspace. But I think when we looked at it, there you know 86% of employees said they're familiar with biometric, 61% said to use it every single day on their personal devices, which actually seemed low to me because I know we did some other research before this survey, and 71% of Americans have biometrics turned on on their personal cell phone. And that was a survey done by Cisco and um was was definitely a bigger subset. So this might just be a skew of of us having a smaller set than the the 20,000 people that Cisco surveyed. Right. Definitely, I think the big thing is people are familiar with biometrics and it's it's normal for them.
SPEAKER_00:Yeah, and it's not like a new normal either. This is what they've been doing for you know probably a decade.
SPEAKER_01:Yeah, and and then the the follow-on question after that was around the openness for biometrics at work. Uh, and I think there's you know the the thing I I look for is the you know, which which who are the people that are hard now. And there were 7% that were not interested um or opposed to using biometrics at work, and then of the rest, 57% were very open, 26% were somewhat open. I think a lot of that was contingent on there were concerns around privacy and security that we'll talk about here in a second. But you know, when you think of 93% of your employees are open to or definitely want to use biometrics for work, and we'll talk about those reasons why in here in a second is definitely a uh a thing that was um it stood out to me that this is a a time when it starts to reevaluate this as an organization, a retailer, and to look at biometric scan.
SPEAKER_00:Yeah, and I think you know, there was in some of the qualitative comments that came with this survey, uh, biometrics was number one in terms of authentication methodology ahead of badge tap, username and password, barcodes, or tokens. And the the statements that support that were biometrics is fast, it's a safe method. I have nothing to lose, nothing to get stolen. It helps me save time, helps me get to work quickly, start my work quickly, and also just makes me stay more efficient.
SPEAKER_01:Yeah, and I think that's that's a comment from a retail frontline worker. That's not something that Lee made up. But we've there were there were probably about there were I think of the the survey respondents, we did a couple hundred surveys, I think it was 300 plus people respond to the survey. Um, of of those, that is a very common type of response. And I think a lot of people feel like the biometrics is more secure. And the the reasons I saw in some of the comments is you know, nobody can steal it, uh, you know, it can't be written down. Somebody, you know, a customer can't look over my shoulder, or a hacker can't look over my shoulder and see me type it in. And I think those things are um, especially some of the newer pieces around like Face Rec where you can do liveness detection. It is very difficult to have a uh, you know, somebody steal your credential. Your token from you. And it used to be with biometrics, if you held up a picture to it, it would you know log you in. And now with some of the advances in AI, it you know, liveness detection has gotten so good where you can you can sniff that out very, very quickly.
SPEAKER_00:Yeah, and I think you know the key here is that your workforce is waiting for you, the IT department, to catch up to the reality of what they're used to on a day-to-day basis. You know, most people spend hours a week on their on their phones, and they're rarely typing in passwords and so uh outside of the outside of their jobs. So I think they're looking for that same thing when they go to work.
SPEAKER_01:Yeah, the next section we had in the survey was actually around biometric preferences for for types of biometric. And I'll start with the tail end, which is voice and um what was it? Yeah, I think like voice and palm. So those were things that people are just not as familiar with. And I think that's driven by the fact that it's not something you have in your your personal cell phone. So it is um, you know, from a voice standpoint, there are also concerns of if I'm sick, my voice isn't gonna work. And then on the palm standpoint, uh there were questions, and this goes along with some of the things that we'll talk about with with fingerprint and voice here in a second. But with palm, people were concerned about what if my hands are dirty, what if the um, you know, what if I'm wearing gloves, it's not gonna work as well. Those those two are they were pretty low, I would call low index on what people wanted. Um, the two that people wanted the most are gonna be uh face and fingerprint. And fingerprint was the highest. And I think the the reason for that of it was at 61% is what came back in the survey, were comfortable with using fingerprint scanning. Yep. And that that aligns very highly to the amount of devices in this is in North America, amount of devices in North America that are enabled with fingerprint reading. So the uh almost all the Android devices have on-screen fingerprint or the backside fingerprint. And then the iOS devices, I think from um the what is it, the 13s and earlier, 13 SEs and earlier are all fingerprints. I know I think my my kids all have the older iPhones that have fingerprint and are super happy with it. But um there are issues with fingerprint with shared devices. And Lee, you want to talk a little bit about a couple of those?
SPEAKER_00:Sure. So from a shared device perspective, particularly with Android, um there's not a way to store those fingerprints centrally. So they have to be stored on each device.
SPEAKER_01:Um that's a cute that's a Google requirement. That's a GMS Google requirement. They won't let you export fingerprints off the device.
SPEAKER_00:Yeah, that's a GMS requirement, exactly. And so what that means at a practical level is if you're sharing devices, you could have to have your fingerprint stored on every device in that store. And there's really no way to know whether or not you've accomplished that. You know, if there's a rack of devices that get moved from the front or the back of the store, things like that, it's just is not something that's typically that's scalable. And you know, if you have 10,000 employees, it it gets pretty unwieldy.
SPEAKER_01:Yeah, I think some of the other concerns that, and this was in the um the qualitative section of the survey was you know, people were worried about the the hygiene of I'm even though you're people with shared devices, you can touch on the screen, like the fingerprint reader is a particular spot everybody has to touch on. Yeah. So there were some hygiene concerns. Uh, other concerns people called out in the survey was the uh I I wear gloves. You work in a loading dock with gloves on, or work in a cold storage area with gloves, or Delhi or anywhere else with you, you have gloves on, or or you have wet hands. Fingerprint readers don't work so well. Um, and then I think the other thing with that is there's certain areas where your hands just get dirty. Like I used to work in receiving in a warehouse, and I would my hands would be filthy at the end of the shift. And I'm pretty confident that a fingerprint reader would either get clogged up or would not work uh with my hands when I was working in in that role, the uh in in the uh the warehouse truck unloading jobs. Um and then uh I think with face, you know, face uh, you know, I think 53% were comfortable with face, which actually seems pretty high considering that you know the 60-70 percent of uh users in North America are using fingerprint. That you know, they more than that was definitely comfortable with face. And I think the advantage of face is you have uh a model that is pretty consistent, even with beards um or with glasses on the face uh rec model, especially from Google, work really, really well with uh determining whether you're the person and face has pretty good liveness detection. So you can tell um the new AI models that are included in a lot of the face models from Google and from Apple are really, really good at detecting whether somebody is alive or not, or whether it's a video. Um, I've played around with the bid and been unable to spoof it. I'm sure if you try it hard enough, you could, but um, I've had no no success spoofing the new liveness models that are available for face rack.
SPEAKER_00:Yeah, and I think you know, from a qualitative side, what we saw was the hands-free side is really is really good. Um you know, affiliate associates like the hygiene of it, they like the speed of it, and also it just feels secure as well because your face is unique to you, right? And you can't, to your point, spoof that. And it also works really well on not just mobile devices, but it can work on tablets that have cameras and even on POS systems that have cameras as well. So you can it's nice to be able to use the same methodology on different form factors as you move throughout your day.
SPEAKER_01:Yeah, and I guess the the next thing to think about is the there's advantages for different departments within a retail organization. I think we there were we talked about the the dual ROI, and I talked about a bit of this earlier, like when with the help desk calls, that goes to the IT budget when somebody has to be on a help desk call. And the opposite side, the guy who is calling the is is going towards the uh COO's budget. So you have operations and you have IT and both of those organizations in a situation where you improve authentication are going to get savings. Uh, so it's it is a uh what do they call it, what do we call it, a dual ROI for the amount of money you can save. And um, I guess Lee, are there other things as you start looking at it outside of just the basic like time spent in the um you know the IT savings for the help desk calls that you've you've seen or you we you we've observed through some of these survey comments?
SPEAKER_00:Yeah, from a qualitative side, you know, at the frontline worker level, the the lack of friction in the workday just adds so much more of a sense of well-being in terms of getting rid of that frustration. Um and it goes back to the satisfied versus happy side of things where people will log in every time they need to do a transaction if that's what the machine makes them do, and they're just gonna make their peace with it. But but they don't, if they don't have to do that, um, that's gonna be just a much more pleasant experience. And there's a cost in that too, from the perspective of retention. Um, so we haven't really even talked about that from the point of view of if people are less frustrated, if they have five or seven micro frustrations every shift, uh times 10,000 people, times eight hours a day, that adds up to a lot of retention issues over time. So I think if you can keep people happy, feeling like they're able to get their jobs done without a ton of frustration, um, that's an another way that you can make this make this make a ton of sense for your organization.
SPEAKER_01:Yeah, I think the retention side also is it's not just the operational frontline side, you also have the IT side because I I think I can't remember the survey, I think it was an IBM survey I read that um 70% of help desk calls were password resets. Yeah, I you know, I've done some help desk and uh insert when I was younger. And like I those are not the those are the the least fun problem to go solve. I would rather be solving more complex problems and helping people with advanced things, like figuring out how to you know get the ledger correct in this app or how to get uh get you a certain view that helps them be productive. I don't want to be doing that same you know pass and reset process over and over again. So I think even on the IT side, it probably helps with retention of your your help desk and your support staff.
SPEAKER_00:That would be an interesting survey, I think on that side, like survey the help desk and see how you can make their jobs better.
SPEAKER_01:Yeah, we we didn't include them in this one, but it would be interesting. And I I would, you know, based on my experiences, I would say I I would rather not be doing passive resets and just focus on some of the more more interesting, complex problems that your help desk could be be helping out with.
SPEAKER_00:Exactly.
SPEAKER_01:Um, you know, I think the the the next area, and we talked a bit about the the other advantages of like driving down tickets, but I I think the we talked about or thought about some of the principles just based on our experiences, uh, you know, from the blue fledge standpoint of rolling out biometrics of what we've learned with uh biometric rollouts and and sort of we I think we call it the seven principles uh for rolling out uh retail biometrics. But the first one is I guess we we titled it uh associate-centered authentication, just starting with with the associate. Can you can you talk a bit about that, Lee, and how you think about that or talk about that with clients?
SPEAKER_00:Yeah, sure. So you know, broadly, I think the term I tend to use the most is user experience. But what that really means is the associate-centered authentication is going to lead with the methodology of login that your associates prefer, not just making them do something uh that meets your minimum criteria from a security perspective. So you want to think about the high frequency with which your associates are using things like the point of sale system, time clock, any shared device, any back office PC. And you need to be thinking about what is going to make that experience for them as preferable and as frictionless as possible. So you're gonna be the things you're looking for here are speed, simplicity, and convenience. You don't want to make it nice to have or anything like that, but you can make this process very pleasant for these people and keep it secure. Um, so I think that's what we're talking about in this situation. And so if you're leading with biometrics, you want to have some biometric fallbacks. Um, but one you can do it in a way that is going to be still acceptable. So things you can have as a biometric effect uh fallback would be like a badge plus pin. And then kind of worst case, I guess, would be password, username and password. And the reason you want to have those things is you want to have the ability for people with different accessibility needs to have different ways to log in. Um, you also want to account for people who are strong, strong objectors, that 7% that we talked about earlier. And then also for edge conditions, maybe somebody's injured, maybe there's a network issue, uh, maybe they have to wear a mask based on um their particular role, like if we're in a clean room or something like that. So you have to take all that into consideration, but really start with the associate experience, not um, you know, the the CISO security experience. I think that's table stakes for sure. But then you need to go that extra step and look at how are the associates going to be using this, maybe up to 30 times a day.
SPEAKER_01:Yeah, I think the the next area was you know, thinking about your your vendors and questions for those vendors, really thinking about yep, what are the different systems you have out there? This goes back to I think the what you started out with of you have all these different systems, where should you go plug things in and start with? And I think it's really comes down to the high frequency of you know, if you have a system that somebody uses 20 times a day, back to my example of the the guy who's doing the picks, yeah. That's a great place to start. You don't have to boil the ocean and put biometrics everywhere. You just have to say, here's the here's the thing that would make it the smoothest. So go look at your software, go look at your hardware vendors, and just figure out where you can plug that in. So just have a general sense of that hardware landscape for your different vendors from both the hardware and software side.
SPEAKER_00:Yeah, I think that's a really good point. You know, if you're you are going to be relying to some extent on your vendor software that you purchased as well. So pushing them toward to think this way too, I think is critical.
SPEAKER_01:Yeah, and yeah, the the hard the hardware too. I've definitely seen some mobile devices and uh computers and things that don't support cameras or don't have a camera on it. So it's it can get uh a camera who it was, but it was somebody likes we don't do biometrics, and I looked at their device SKUs and they they only did rear-facing cameras for the device SKUs because they wanted to save$20 per device. And I was like, sorry, you're gonna you're gonna have to stick with uh with NFC badge tap or with uh with passwords for now.
SPEAKER_00:Yeah, would you rather save$6.2 million? You know, I think is another way to look at that same question. Yeah.
SPEAKER_01:Yeah, I mean 20 10,000 devices times$20. They did save uh they did save 200,000, but yeah, they yeah, the ongoing cost. There's a lot of hidden costs there. Um the next thing I think on the list of of just thinking about implementation is privacy by design. And this is I think this is really important and goes back to a lot of the the things that were articulated in the qualitative section from uh the feedback from employees we surveyed. And you know, they they privacy was a concern. People have they don't want their face stolen, even though they're they got 10 trillion pictures on Instagram, TikTok, and Facebook, they're they are worried about their biometric data being stolen, which is I've definitely seen some some concerns with this recently in various scenarios. But I guess Ali, as you think about the the privacy by design uh part of this, what what comes to mind for you?
SPEAKER_00:Sure. So I think you know the trustworthiness for that employee is what they're looking for. Um so when you're storing this information, you want to store a biometric template, not a raw image, right? Or no, there's no actual face photo or fingerprint image that's being stored. Um you want to make sure that those uh templates that you're using, like for the face template or fingerprint template, are encrypted when they're in transit and when they're in storage. Um and then we talked about this too from the fingerprint side of things on Android devices with GMS. You want to understand the trade-off of storing something on device versus a central encrypted storage. Um, just the security that you need to think about with that, but then also the scalability if you're doing everything on device. Um, and then what you want to do as well to alleviate these concerns and show your workforce that these are trustworthy methodologies. You want to publish policies and be very clear and simple on what is collecting it, how it's being collected, where and how it's stored, how long it's being stored, and who can access it and for what purpose. Um, and you don't have to do that. Yes, there will be a huge privacy and and uh you know security document somewhere that has all the details, but I think you can do that at a very high level, very clearly and simply for people to make them feel at ease. Um, and then finally, you want to be able to offer an opt-out to these folks because there are some people that are just not going to be comfortable with this. But that doesn't block you from rolling it out to everyone, just give them a meaningful alternative. It could be NFC badge plus pin, and it could be um, you know, just back to standard password with uh a username and password combination. So you don't want to stigmatize or ostracize those people, force them to do something that they're not comfortable with.
SPEAKER_01:Yeah, you're you're already doing username and password, so it's not a not a heavy lift for you to continue having that as a fallback for those users that just aren't comfortable with the the biometrics.
SPEAKER_00:So it's that's and then you know what we saw before is 90% of those people are already satisfied with that, so you should be good.
SPEAKER_01:Yeah, and then I think on the the shared device, we talk about this. A lot of retailers are I would say shared devices are they're the most cost-effective way to have a consistent experience across everything. I know I think Walmart did a a rollout of Xcover Pro, Samsung Xcover Pros to all their employees. And um, I've gotten mixed feedback from employees that I uh talk with when I shop there. But it's you know, some people love it, some people are lukewarm on it. But I guess most retailers that we work with are using shared devices, which is a device that is in the store and a shift comes in and uses it, you know, next shift will uh you know grab that device if it's charged or grab it and swap the battery if it's not. Um, so that's the the general modality we see for a lot of people that are using these shared devices. But from that standpoint, what are the things we need to think about for shared devices, particularly with biometrics?
SPEAKER_00:Yeah, for sure. So, you know, like you said, these devices are being constantly grabbed throughout the shift. And it's not like I'm I would pick up a device for my full shift and I would be the only one that touches it. I talked with a customer yesterday who has 20,000 devices across their stores, and he told me that oftentimes three, four, five people are using the same device in the course of the same shift. So, what that means is you've got to have fast user switching. You know, if I've got this device, Brett, and then you come and pick it up and you need to do something in a different app that I might not have access to, you need to be able to switch and be in that device under your name in seconds, not three minutes. You don't want to reboot the device. Um, you don't want to have to re-download the apps. So the retail grade solution on these devices really has to be rapid user switching. And then you want to maintain that single sign-on across all the applications so that that one biometric scan is gonna unlock everything because we're really trying to avoid just downtime and dead air. Um, and then you want to look at also the security side of that. So you want to respect session timeouts and locking rules on the device. So, for example, coordinate your session timeouts with the length of a shift, but then also make when a device goes to sleep re-authentication very easy as well, um, so that you can keep people working and not standing there trying to figure out how to log back into a device.
SPEAKER_01:Yeah, and I I like and we've at Blue Flash, we have a biometric solution. I I love the demo aspect of by the time I pick up a device and I powered it on, I'm actually like focused on the screen. It's I'm already back in. And so it's very frictionless. And so it's easy, it is almost easier to have better security because you could set your time out windows lower because there's such lower friction when I pick the device and try to get back up into my session. So it's I definitely think the biometrics make that a lot more advantageous and more secure for the security folks that want to have a shorter timeout period of uh when a device is not use.
SPEAKER_00:Yeah, I hadn't thought of that from a shorter timeout period, but that is definitely true because of the speed, you could make the timeout period much, much shorter. Um, and I know that also in some shared device environments, there's a concern that the people who are that originally signed into the device are the people that are completing the work. So if you had shorter session timeouts forcing more authentications, you could definitely confirm that the correct person is doing the work as well. So there's some compliance side of it just from a HR perspective, but then from the security side too, it's more robust.
SPEAKER_01:I definitely had had that conversation with a shipper that did high value cargo where um the person signing the the Uh the manifest when something got inbound or outbound, they wanted to validate and biometrics gave them 100% accuracy. You and I could share a password or I could log in, hand you a device, but they were actually forcing uh a biometric reoff when one of those transactions occurred. So they know the exact person that was doing the transaction. I couldn't have I couldn't pick up Lee's uh device that he left on the desk and actually start you know closing out the manifest saying there are only 12 containers on the the truck when there are actually 10. So it's um it it that was an interesting case too because I didn't even think of that the benefit of biometrics there, but it gave them um a high level confidence of who actually completed that load and did the closeout.
SPEAKER_00:And that even translates outside of you know retail into if you think about like regulated industries um or even things where privacy is a is a concern around like uh medication dispensing or things like that.
SPEAKER_01:Yeah, or in in retail, I think the other one too I think about is like POS overrides. Oh yeah. You know, if somebody knew your login or code and did a POS override for you know a$50 discount on a$55 item for their friends, it's uh that that go comes back to you, even though it wasn't you weren't the person that had that transaction.
SPEAKER_00:Right. Would you would be the one giving up free chickens all day, right?
SPEAKER_01:Oh no, not me. Not me. Uh robust and in edge conditions. This is uh the next area to think about when you're looking at implementation. And edge edge conditions are always my favorite because uh people will ask, what are the edge conditions? And I'm like, well, you're not gonna know until you actually pilot it. But uh, you know, I think some of the ones we we do know about are uh what is it, network, the actual physical aspects. So temperature, uh humidity, uh gloves. Like temperature is an interesting one, like when things are very hot or very cold, uh different devices have different aspects. Um, but I I guess you know, Lee, is there anything else you could think of when you think of the edge cases that people should look at as they're piloting and testing a biometric solution?
SPEAKER_00:Yeah, I think you know the two you mentioned are critical, obviously, from a network connectivity and then also just physical limitations of heat, but also there's things like if you're wearing any sort of PPE, gloved hands, wet hands, dirty hands, um, you need to think about that. But then your solution needs to work offline or with intermittent connectivity. So think about we've talked about this in other podcasts too, but maybe some sort of on-prem backup if you're um working in an environment where the power goes out in the store a lot. Um, you also want to optimize for real real world lighting, real world, real world motion, and real world conditions. So don't just test this in the lab at corporate, actually go hand this to uh an associate in the back of a store and figure out, you'll figure out pretty quickly what the other cases are that you hadn't thought of. Um, so what you want to do is just be aware of those things in the the real practical way. And then I'd say the biggest part is you want to the way we worded this is you want to fail fast and clearly. And what that means is in a situation where biometrics is your preferred uh methodology for authentication, if that's not working because of maybe one of those things that we just described, you want to have a simple backup that's readily available immediately. So, and it's not the 45-second entry if you can avoid that. So you have options like alternatives like NSC plus plus a pin that you can do if face isn't working because it's particularly dark, or maybe you're wearing a mask that day, something like that.
SPEAKER_01:Yeah, 100%. Um, the next area we had an implementation, Area Six, was just you make sure you understand how to integrate with your uh your existing identity and uh your existing endpoints. And I think this is uh maybe a little bit of a dig on some solutions I've seen out there where they want you to drop in their identity provider and then federate that to yours and refederate all the apps or have all the apps where they have a trust to a new identity provider specific to the biometric. And I think that is a very expensive lift for IT and creates a lot of friction. So I think the as you're looking at solutions, understand, you know, does it work if you're on intro? Does it work with intro? Does it work with Okta? Um, how does it handle your, you know, integrate with your multi-factor? So if you require MFA, how does it work with that in certain situations? How does it work with uh conditional access policy? So there's a lot of I think that's a it's more of an IT one to think about, but you know, as you're looking at vendors, make sure you look at vendors that can tie in easily with your existing solution without you having to you know rip out your entire uh intra ID infrastructure and put in something new.
SPEAKER_00:Yeah, or something next to it, like you said initially. I like the phrasing we came up when we were talking about this is you don't want to have to create a parallel security universe in addition to what they're already maintaining.
SPEAKER_01:Yeah.
SPEAKER_00:Um, because you know, again, that's another operational expense, right? So there's the software cost that goes along with that. And then are you going to have to add extra IT people to maintain the system that you just created or that you bought into? Um, I think another part of that is that you have to make sure it works with your existing device management tools where you're governing these endpoints. So that's something to consider as well. And um then I think the other one, and it goes back to what you said, Brett, about um integrating with your existing identity providers, you want to use standards-based SSO whenever possible. So that's something to talk to your vendors about too. So that means like OAuth, OIDC, or um MCL. You don't want to try to use something building your own auth standards because it just gets very, very unwieldy. Um, and then I think finally, when you're thinking about this from an IT perspective with your security and integrating this, you want to make sure you're having auditable logs that can be pulled out and correlated with your point of sale system, with your security systems, and also with HR, so that you have a unified system of truth in order to understand, you know, who was working when, where they were working, what applications they may have been using, where they were in the store, what transactions they were completing on the point of sale system.
SPEAKER_01:Yeah, I think it definitely increases your security possible. One one caveat, uh, we when when Lee says standards-based SSO, uh, I I'll throw the word modern standard-based based SSO in there. I think we had somebody that's like, uh, we use uh DB2 uh uh RBAC on our IBM AS uh uh and I'm like, nope, nope, we're not gonna support the S400s. We're uh uh do you have anything newer? And so I I think it's you know, if if you do have that, it might be time to look at uh maybe some other pieces first before you look at biometrics and getting those pieces in place.
SPEAKER_00:Yeah, there's uh with that example, there's definitely a crawl, walk, run kind of thing going on there.
SPEAKER_01:Yeah, make sure you have some of the underlying foundational pieces in place. Um the the next one, you know, from a implementation standpoint, it's just understanding the operational sustainability. So, you know, does it reduce support load? Does it uh, you know, do you have reporting on actual usage that your IT and operations teams can have? But I guess for when you think of operational support, like what what are the things that come to mind as as you talk with clients, Lee?
SPEAKER_00:Sure. So I think what they need to look at is hey, I've got this up and running or I've set it up. I've spent weeks or months configuring this. Now it's day one and day two, and I've got to run this on a day-to-day basis. Um, you want to make sure that you're reducing that support load. Um so you want to have the centralized policy on how this is working, meaning you can enable or disable biometrics by a particular store. If your company owns more than one store banner or brand, you know, enable it or disable it by banner or brand, or even by region, um, so that you don't have this really messy, non-centralized version of how people are logging in. Because what you're gonna want to be able to do is report on this at a macro level, because you need to understand adoption rates, um, since success and failure rates of the actual biometrics working. You want to understand the login times. Like if you were averaging over 30 seconds before and now you're down to let's call it three, you want to be able to understand that so you can report on it. And then the other side of it, correspondingly, you're gonna want to look at your help desk tickets pre and post-deployment. Because if you can't measure these things, you're not gonna be able to prove that ROI. And as the COO, as the CIO, these are the things that you are ultimately judged on. And these are the things that are gonna help the people on your team um save time and realize advantages for the company.
SPEAKER_01:That's a a good segue into the last thing we're gonna talk about here, this this uh in this podcast. But I think the the thinking through a you know, how do I go from you know nothing to this of, and I think there's really three phases to this. And the the first one is setting up a pilot or doing a pilot of this technology. Maybe you could talk about some of the key points, Lee. You you coach clients on when you think about a uh a pilot phase.
SPEAKER_00:Sure. So we actually had a customer that did a 5,000 device deployment. And prior to working with Blue Fletch, or prior to implementing Blue Fletch, they actually did a before and after single sign-on, how long it took to sign into an application manually versus single sign on. So what they did and what we often recommend to people is establishing a baseline of login times, ticket volumes, um, associate satisfaction scores, like where they are now. Because if you don't understand where you're starting, it's not gonna give you a good way to measure how much before and after success that you have. Um, so once you've got that baseline there, you then want to go and find store champions. As everybody knows, no one likes to change. And it's only gonna take one or two people who really don't want to change to be vocal about it to ruin it for everyone else. So if you can identify store champions who are really the early adopters who love to push themselves, love to put to push the technology and are going to be evangelists inside of your uh facilities, definitely look for those people. Um, so we talk to our customers about that as well. Um, you know, because they will ask us, like, well, how do I roll this out? And you say, well, pick a subset of users in a subset of stores who you know are going to be your champions and start with them.
SPEAKER_01:Um I also find like that champion is sometimes the guy that complains the most is the best guy to have.
SPEAKER_00:Yeah.
SPEAKER_01:Because if you if you A, he's gonna give you the most feedback and find the most edge cases, and then B, uh, you know, if you can win him over everybody else in the the stores, like, oh, Steve's happy with this, you know, must be ready to go. So yeah, I a lot of times people will go with like, who's the most tech savvy guy? I'm like, uh, maybe who's the guy that complains the most? Go go with that guy.
SPEAKER_00:Yeah, I mean, I think sometimes those people complain too uh because they don't feel heard, and giving them a chance to participate can really turn someone like that around. Um, and so if you're using shared devices, most of the people we're talking about here are, you know, consider leveraging facial recognition because you're not going to be restricted the way you would be with fingerprints. So fingerprints, even though it is the most familiar way for most people based on their personal device usage, it's not necessarily realistic in a shared environment. So make sure you pick the modality of login that's going to make the most sense for the device type and the device landscape that you have. Um, so and then going back to what I mentioned just briefly a second ago, start with a defined subset of stores or even a section of a store first and then go from there. Pick a particular type of device first, like don't go point of sale, um clock, kiosk, PC, and shared device all at the same time. Start in little pieces. Um, it's worth it to do it that way because it helps you manage those store champions and build from there. And then also helps you understand the edge cases that are going to cause problems at a limited level rather than en masse, where if something gets out and then breaks, it's a lot harder to bring people back around.
SPEAKER_01:Yeah. And then once once you have your pilot, I think phase two we talk about is refinement, which is uh, I think the listen and understand the edge cases and then continue iterating. Can you talk a little bit about the the learnings there, the experiences we have there?
SPEAKER_00:Yeah, absolutely. So we when we talk with customers, we often tell them, you know, now that this is rolled out, work on collecting structured feedback from these associates. Like, is this faster? Is this more frustrating? Is this less frustrating? And then based on what they say, you know, make be prepared to make some changes. Um, if there's going to be privacy considerations or privacy questions, go back to what we talked about earlier with clear, repeated, simple explanations of how this data is stored and used. Um, and then you know, use that pilot to find these edge cases that you didn't find in the lab because they always come up. When you put a device in a user's hand, they're going to find something that you never thought of because you wouldn't think somebody would use a device in that manner, but maybe they do every day. Um so what you're going to be able to do is use this phase, this pilot, to um refine how the workforce is enrolled and switches over from your old methodology for authentication to the new one with biometrics. Um understanding like the offline behavior and also understanding failback or fallback flows. If biometrics don't work, what is the next method for authentication going to be? And how easy is it to pivot from biometrics isn't working because I'm wearing a mask? If I need to do NFC plus pin, how does that work? If I need to scan barcode plus a pin, how does that work? And make sure you have a clear process for that.
SPEAKER_01:Got it. And once you've nailed all that and have what you think is a good product and you're ready to call it scale, scale to enterprise, what are some of the things to go, you know, lessons learned there as we've helped go from a pilot of a couple stores and iterating and then solving those issues to getting everything getting rolled out across a chain of stores or multiple banners in a chain?
SPEAKER_00:Yeah. So I think part of what the pilot does is it allows you to have success metrics, right? So begin the rollout on mass after the pilot proves what you've identified as your success metrics. So an example here would be faster logins, uh fewer help desk tickets on password resets, uh, and then higher satisfaction scores from your associates. Um if you start with a clear goal that the pilot is proving, then when you roll out, you'll have something to measure at a broader level to make sure that your pilot is in fact correct. Um, and you're gonna want to standardize on what your primary method of authentication is. In this case, for biometrics for shared devices, it would be face. And then you're gonna want to standardize on whatever that fallback is, maybe it's passwords or badge plus pin or you know, uh barcode plus pin, whatever you decide is that secondary. Make sure you have a clear one, two, three. This is how you authenticate on these devices so people know what to expect.
SPEAKER_01:I think the last piece of that was uh change management, which uh I know you're you're a big uh big proponent of. You know, no one likes getting a bunch of software dropped in their lap and being told, hey, there's new software.
SPEAKER_00:Yep. That's my favorite thing in the world. We did something, we didn't tell you what we were gonna do, but here it is. Do you like it? Um so yeah, it's a it's an HR, it's an HR consideration, it's a employee experience consideration, it's a relationship consideration. It's not just a tech deployment, right? Um, and you need to be thinking about this from a legal perspective, from a you know, from a when we're talking about the privacy side of things. And also if you happen to be in an area where unions are involved, you're gonna want to make sure you involve all those stakeholders early on because you need to talk about employee feedback, you know, security, um, safeguards, privacy safeguards, and then just also data in terms of how much better this is allowing the people to perform their jobs.
SPEAKER_01:Yeah, I there's two things I like around this I've seen the companies too that have rolled out big solutions. One is the the store expert, store advocate, back to the the initial guy that was the the first guy, um, getting him to be like an advocate for the store or finding somebody in the store who's a strong advocate and can talk to other people. And then the other one is train the trainer programs, which is you don't don't you don't have to take a trainer team to every store if you can get one person to come in and you know go to the district office and learn how a thing works and then go back and teach their store about it. So find you know those trusted advocates and identify those people you want to be train the trainer uh program uh associates.
SPEAKER_00:Yeah, and I think it goes a long way for you know employee morale too, when you've got a group of people who you're taking to the corporate office or the district office and enabling them and giving them ownership and a stake in the success of this process that's going to be much more likely to succeed on the ground in the store when your associates feel like they were helping solve the problem and they had a say in how it was rolled out and how it was implemented.
SPEAKER_01:Got it. Uh I know I think we're we're coming off the end here, but Lee, I appreciate you walking through this. Um, the there will be a white paper Blue Fletch is going to publish with the uh outputs from the survey and a lot of the survey survey data pieces for folks to take a look at. So keep an eye out for that. And then we are also demoing some of the newer biometrics capabilities that Blue Fletch has rolled out this year at NRF, the upcoming NRF. So if you're interested in that, come by, take a look at the booth. But uh as always, Lee, appreciate you talking through this and sharing some of your experiences with me today.
SPEAKER_00:For sure. Looking forward to NRF in January in New York as well.
SPEAKER_01:Excellent. Thanks, everyone. Have a good one. Take care. Thank you for tuning in to Frontline Mobility Edge. If you enjoyed this episode, make sure to subscribe for more content every month. If you'd like to learn more about Blue Fletch, check out the link in the description or visit at bluefletch.com. See you next time.