Your threat model and your time-to-lock setting
I suppose I'm kicking a hornet's nest, but I want you to know I'm doing so in good faith in an effort to better understand the world I'm in.
What I would like to know is what specific threats are being mitigated by 15 minute and shorter inactivity lock settings on your user workstations. That seems to me like it creates more of a hinderance than a security benefit, at least where I work, where people have their own offices and a solid respect for others' stuff.
Of course, I know that the standards are different, and I'd like to hear more about the world that makes these standards the norm. Would people in open floor plan offices routinely send NSFW emails from unattended neighbor workstations? Are foreign agents piggybacking into your workspaces and forwarding blueprints to their diplomatically immune handlers? Is Ted from Accounting an incorrigible prankster?
While I'm asking these questions tongue-in-cheek, I am genuinely curious why my experience differs so much from the experience of businesses that would need this particular control. Real-life "idiot left his computer unlocked" stories welcome, just to open my eyes.
*This post inspired by the recent mouse jiggler post.*