What are the signs that an organisation is still too reliant on passwords and weak identity practices?

The clearest signs are repeated password prompts, slow authentication workflows, and a security culture that still tolerates frequent credential entry as normal. The report found that more than half of respondents enter passwords six times or more per day, which is a strong indicator of friction and persistence of legacy authentication. Heavy password use also increases exposure to phishing and reuse-driven compromise.

How to recognise password dependence in day-to-day access behaviour

The most visible signal is operational friction: people are still being asked to type passwords constantly because the environment has not moved toward stronger session, device, or token-based trust. That usually shows up as repeated prompts, brittle logins, and users normalising credential entry as the default way to access everything.

A second signal is that authentication still depends on habits rather than stronger controls. If users can reuse the same pattern across many systems, or if password resets and help desk recovery remain routine, the organisation is still carrying avoidable exposure in its access layer.

More than half of respondents enter passwords six times or more per day, which is a useful benchmark for how much legacy authentication friction can remain embedded in normal work. That level of repetition is not just inconvenient, it often indicates that password-based access is still doing too much of the security work.

What weak identity practices usually look like behind the scenes

When an organisation is still reliant on weak identity practices, the problem is rarely only the password itself. It usually includes weak recovery paths, inconsistent multifactor enforcement, poor conditional access, and a tendency to treat authentication as a one-time event instead of a continuously managed control.

Weak identity practice also shows up in weak governance signals: shared accounts that are tolerated, unclear ownership for access exceptions, and limited visibility into where credentials are stored or reused. Those conditions make it harder to know who can access what, and harder to prove that access is still appropriate.

For broader identity hardening, it helps to compare the human-login experience with the organisation’s wider identity posture, including how it handles service credentials and secrets in practice. NHIMG’s Ultimate Guide to NHIs is useful here because it frames the governance and lifecycle issues that often mirror the same control gaps seen in weak human authentication.

Why the risk persists even when passwords seem “good enough”

Password-heavy environments remain attractive to phishing, credential stuffing, and reuse-driven compromise because the control depends on secrecy and user behaviour rather than stronger proof of possession or phishing resistance. Once users are expected to enter passwords frequently, the organisation creates more opportunities for capture, reuse, and fatigue-driven mistakes.

The underlying failure mode is often not a single bad password, but an access model that still relies on credentials as the primary gate for too many actions. The more often users are forced back to passwords, the more likely the organisation is to see avoidance behaviour, weaker workarounds, and increased support load.

That is why it is worth treating repeated password entry as an identity signal, not just a usability issue. If login is still the dominant control, the organisation has probably not yet reduced the attack surface enough to make stronger authentication feel normal.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-63	Phishing-Resistant Authenticators — Phishing-Resistant Authenticators	Repeated password use points to weak auth that 800-63 addresses with phishing-resistant methods.
Recommendation — Adopt phishing-resistant authenticators to reduce password dependence and credential phishing exposure.
NIST CSF 2.0	PR.AC — Identity Management, Authentication and Access Control	The question is about identity strength, access friction, and authentication hygiene.
Recommendation — Strengthen authentication and access control so frequent password prompts are no longer the norm.
CIS Controls v8	6 — Access Control Management	Weak identity practice shows up as excessive prompts, weak recovery, and poor access governance.
Recommendation — Enforce access control management to reduce reliance on passwords and tighten identity workflows.
OWASP Non-Human Identity Top 10	NHI-01 — Identity and Access Management	Password dependence often mirrors broader identity governance gaps across human and non-human access.
Recommendation — Apply identity governance controls to reduce credential overuse and improve access assurance.

Practitioner Guidance

What to verify: Check whether the repeated prompts are caused by short sessions, poor SSO coverage, broken conditional access, or legacy apps that still force reauthentication. Those causes have very different remediation paths, and confusing them leads to cosmetic fixes.

Decision rule: If password entry is still the primary daily control for core applications, treat that as a sign to prioritise phishing-resistant authentication and session redesign before polishing password policy wording. Stronger policy text does little if users are still pushed to type secrets repeatedly.

What practitioners underestimate: Frequent password use is often a symptom of control fragmentation across apps, devices, and exception handling. The most meaningful improvement usually comes from reducing how often credentials are needed, not from asking users to manage them more carefully.

Practitioner takeaway: The mature-state test is not whether passwords exist, it is whether the organisation can keep users productive without making password entry the default proof of trust.