Strategy · Competitive exposure

The Friction Attack Surface

AI prices the attention your customers used to give you for free. Every piece of wrong friction is now an attack surface — find it by auditing human touches like incidents.

Scott Farrell · LeverageAI · Full doctrine companion available as multi-chapter ebook

I want to play pickleball — not refresh the page in the stupid app.

That sentence is not a product review. It is a competitive map. A local sports club moved off a wretched discovery platform onto a modern multi-sport booking app. The admin team felt relief. Sessions still filled. Conversion still happened. And a willing, paying regular still spent twice-weekly attention translating the same stable intent — this club, this sport, Sundays and Wednesdays — into someone else’s ontology: search near me, pick the sport again, wade past other codes, distinguish tiny booked badges, open events that cannot be booked, absorb half-screen branding written for first-time acquisition.

The product “worked.” The attention tax never appeared on anyone’s P&L. Until AI made that tax an attack surface.

Attention was free until it was not

Historically a provider did not need to eliminate friction. It needed friction below the abandonment threshold. Ten clicks that still produced a booking looked, from the inside, like a functioning system. The company saw conversion. The customer experienced unpaid inventory reconciliation.

Human attention was a free external resource. Open the app, re-express location, re-express sport, interpret inventory, remember what is already booked, work out what is unavailable, click. Almost none of the durable intent changed. The interface behaved as if it had cognitive amnesia.

Customer-effort research has long said the quiet part out loud: high-effort interactions destroy loyalty far more reliably than “delight” builds it. In the CEB / Gartner lineage that created Customer Effort Score, roughly ninety-six percent of customers with a high-effort service interaction became more disloyal, versus about nine percent after a low-effort one.¹ McKinsey’s personalisation work found seventy-one percent of consumers expect personalised interactions — and seventy-six percent get frustrated when they do not get them.² Nielsen Norman’s classic heuristic is blunt: interfaces should minimise memory load; users should not have to recall information the system already holds.³

AI changes the economics of that unpaid labour. Another system can absorb the translation steps once, hold fuzzy durable intent (“beginner-ish, Sundays and Wednesdays, this club, don’t double-book me”), and return the human to the terminal outcome. That is not a nicer filter. That is friction arbitrage.

Necessary, accidental, wrong

Not all friction is a bug. The useful taxonomy is three classes.

Necessary friction survives AI. Authority and capacity do not vanish because models got better. Accidental friction is the legacy tax. Wrong friction is the competitive vulnerability — the seam an AI-native entrant attacks while the incumbent still thinks its competitors are other booking apps with nicer waitlists.

The incumbent promise is usually: “We make booking easier.” The attacker asks a different question: “Why is the customer booking at all if intent is stable?” That is Terminal Value altitude in miniature — not feature comparison, value migration.⁴

Your analytics may call friction “engagement”

Here is the nasty inversion. The customer says: twelve clicks of fuckery. The dashboard says: opened app, searched, viewed event, clicked event, booked — engaged user.

Session time, search frequency, and return visits can be symptoms of a missing intent layer, not product love. If the system cannot hold “keep me in suitable sessions,” it must conscript the human as the join algorithm between provider state and personal state (calendar, preferences, existing bookings, fatigue after a late night). The customer’s brain is middleware. Middleware looks busy. Busy looks healthy.

That is almost perfect disruption bait. The organisation optimises to preserve the very interactions that prove the architecture is dumb.

The Human Touch Audit (customer side)

Treat every customer appearance as an incident.

HUMAN TOUCH DETECTED
        ↓
why?
        ↓
Was judgement genuinely required?
Was new intent required?
Was authority required?
Was consequence exceptional?
        ↓
NO?
        ↓
DESIGN FAILURE

Worked example: a regular opens the booking app at 8:13 pm. Why? To learn whether a suitable future session has become bookable. The software already has event availability, release state, existing bookings, club, sport, session type, and past behaviour. An intent-holding system could already know the preference pattern. So why did the human appear? There is no good answer. He appeared because the architecture is dumb.

This is not an argument against white-glove service. Human contact can be brilliant when it is judgement, relationship, or authority. Unnecessary operational interaction is a cost — on the customer side as unpaid attention, and on the provider side as routine labour mislabelled as hospitality.

The design question that keeps you honest (without designing the replacement product here): what would this look like if the customer touched the interface once, at setup, then never again? Sibling doctrines own how personal agents and addressable services actually do that work. This piece owns the diagnosis.

Someone has the key (provider side)

Run the same audit on staff presence.

A two-hour session, thirty players, a thin per-player contribution. Players put the nets out, pack them away, rotate themselves, clear debris, play, socialise. The on-site person arrives, unlocks equipment, perhaps greets, plays a bit, stays. Ask: why is the human present?

• Safety supervision? Apparently not much.
• Coaching? No.
• Refereeing? No.
• Court maintenance? Players largely handle it.
• Matchmaking? Self-organises.
• Equipment access? Yes — someone has the key.

If presence decomposes to biological access control, an electric lock with temporary credentials for authorised attendees turns routine presence into exception handling. Equipment missing, pack-up failure, access fault — human gets involved. Otherwise the market clears and people hit the ball.

Provider-side wrong friction is the silent twin of customer-side click tax. Both are human touches that fail the audit. Both are attack surface when an AI-native operator redesigns around exceptions rather than ritual presence.

The baseline trap — and decision defence

Meetup was horrendous. Call that pain 100. The club moves to the new app. Pain is 55. Everyone says: so much better. They are benchmarking 55 versus 100. The customer who still wants zero unpaid translation is benchmarking 55 versus 0. Completely different analysis.

It feels really good when you stop hitting your head against a brick wall. Relief is not excellence.

The organisation becomes adapted to a horrible environment — workarounds, WhatsApp supplements, staff explanations, customers who learned the terrible path. A replacement removes the most grotesque problems. Cognitive search terminates: solved. But the new system may still be structurally bad measured against what cheap cognition makes possible.

Then comes the psychological layer. The owner just paid the migration cost: research, move everyone, explain the process, absorb complaints, finally get the new system running. A regular says: still frictional. The owner does not hear neutral product evidence. He hears that the painful decision may not have solved the problem. So he becomes invested in proving the migration was right. Screenshots appear. “We announced it here.” That is not customer service. That is decision defence.

He has confused “better than the last system” with “good.” Because the last system was a brick wall, the blackberry bushes feel like a spa day.

Apps as packaged interaction obligations

Zoom out. A phone full of apps is often sold as ecosystem richness. From the friction lens it can look like three hundred separate deterministic systems that periodically require the human to visit and manually translate intent into each domain model. Airline, bank, sports, car, health, insurance, council — each says: we built the backend; you are the orchestration layer. Find us. Open us. Authenticate. Remember our UI. Navigate. Interpret state. Close. Repeat next Thursday.

The precise claim is not “apps are dead.” It is sharper: every app interaction must now defend why the human is present. Some interactions survive — genuine browse, genuine new intent, genuine authority. The rest is attack surface.

McKinsey’s agentic-AI work lands in the same neighbourhood from the enterprise side: realising agent value means rearchitecting task flow and reallocating responsibilities between humans and agents, not layering automation on inherited click paths.⁵ Bain’s zero-based redesign argument is the clean-sheet cousin: productivity on the old process is not the same as redesigning the process.⁶ Stop Automating, Start Replacing owns the full replace-versus-automate doctrine; here we only need the competitive edge of that truth — greasing wrong friction is not removing it.⁷

How to find your exposure this week

1. List ten repeat interactions a loyal customer performs to get a stable outcome. Mark each step necessary, accidental, or wrong.
2. Run the Human Touch Audit on every customer appearance in that journey. Write one sentence: why did the human appear? If the answer is not judgement, new intent, authority, or exceptional consequence — design failure.
3. Run the same audit on provider-side humans. Decompose presence. If it collapses to “someone has the key,” you have found biological middleware.
4. Check your metrics for inverted friction. Which “engagement” numbers rise when customers are doing unpaid translation?
5. Name the baseline. Are you still celebrating 55-vs-100? Write the 55-vs-0 sentence out loud. Watch for decision defence when someone challenges the last migration.
6. Do not design the replacement yet. Diagnosis first. What replaces the interface on the customer side and the service side is sibling work. Market redesign is sibling work. Your job this week is the map of exposed friction.

Barely good enough is where disruption lives. If your system is only just good enough that it is not useless, you are not safe — you are inviting the entrant who notices the tax you never put on the books.

Find the attack surface before they do.