My application is required by our security team to log users out after 20 minutes of inactivity. We don't currently have a message warning users that this will happen, leading to confusion/frustration for users. Is there an industry for how soon a message should appear? The last 10% of the timer? I.E. 2 minutes in my scenario.
There is no industry standard, but there are plenty of patterns, best practices you can use.
I think, you should do a so-called best practice research and examine similar applications, services. Typically, the banking sector and eGov sites are using timed login solutions for security purpose. For example, the most common element of these is a time counter. And usually, there are no popup before it logs you out. If the user reaches the inactivity threshold, it assumes that the user is no longer at the computer and logs it out without any warning to prevent any security issue. If the user is not there, no popup message or dialog will help or work. This is why they are using a counter instead. There are several solutions. Some of them resets the count-down after each interaction and have a few second delay.
For example, it starts to count down the timer after 20-30 seconds of inactivity (this is the delay) and resets the counter right after the first interaction.
The count-down shows 10 minutes > the user did something on the webpage, filled some forms, etc. > then moved to another tab of the browser or had to go out for his/her wallet because the form is asking for ID or credit card number > the count-down starts after 30 seconds of inactivity > the user gets back after 3 minutes, the count-down is currently showing 7 minutes 10 second > the user stars to type the credit card number into the input field > the count-down resets back to 10 minutes.
I don't think there should be any warnings or popups. For example, if there's actually an intruder who gets their hand on the computer / mobile phone with your application logged in, and a popup appears with the reminder, it will be even worse for security. The whole point of session time out is logging the user out if they are away and unintentionally forgot to log out of the application.