2020 cybersecurity trends exposed identity gaps in remote work

At a glance

What this is: Axiad’s 2020 retrospective says remote work, MFA growth, regulatory pressure and major breaches all exposed the limits of authentication-only security.

Why it matters: It matters because IAM teams must treat device trust, password handling and access governance as part of the control plane, not as afterthoughts to MFA rollout.

Context

Remote work moved from a managed exception to a default operating model in 2020, and that shift exposed how much identity control was still built around office-era assumptions. Once users began connecting from unmanaged networks and mixed-use devices, password handling, temporary access issuance and device verification all became governance problems as much as authentication problems.

The article ties that shift to a broader IAM lesson: stronger authentication does not automatically create stronger access governance. MFA reduces some risk, but if organisations still rely on shared temporary passwords, weak device assurance or user-driven workarounds, the identity attack surface remains open.

Key questions

Q: What breaks when MFA is treated as the whole identity strategy for remote work?

A: MFA reduces credential theft risk, but it does not fix weak recovery processes, unmanaged devices or user bypass behaviour. In remote work settings, those gaps become the real attack surface because attackers often look for the easiest path around the login prompt. A useful programme treats MFA as one control in a larger access governance model, not as a substitute for it.

Q: Why do temporary passwords increase identity risk?

A: Temporary passwords increase risk because they shift trust away from the primary authentication process and toward a weaker recovery channel, often email or help desk handling. That makes the emergency fix an attacker target and creates a path that may not meet the same assurance standard as the original login method.

Q: How do security teams know whether zero-trust remote access is actually working in practice?

A: Security teams should look for evidence that users only reach approved resources, sessions are brokered through controlled gateways, and access decisions are enforced consistently across cloud and on-prem systems. Strong signals include reduced reliance on VPNs, clearer session logs, and fewer over-privileged connections. If users can reach unrelated systems easily, the zero-trust model is not being applied effectively.

Q: What frameworks matter most for utility identity governance and compliance?

A: NERC CIP is central for utility compliance, and identity controls should also align with the NIST Cybersecurity Framework 2.0 for governance, access control, and continuous improvement. The practical test is whether the programme can demonstrate least-privilege access, prompt removal, and auditable decision trails across the full estate.

Technical breakdown

Why remote work breaks office-era identity assumptions

Remote work changes the trust boundary around identity. In an office model, organisations can rely more heavily on managed devices, predictable network paths and in-person support channels. Once users work from home, the organisation must verify the device, the session and the access path without those assumptions. That makes device posture, password handling and support workflows part of identity security. Temporary passwords are especially risky because they create recovery paths that attackers can abuse when users are locked out or operating under pressure.

Practical implication: treat remote access as a governed identity journey, not just an authentication event.

Why MFA reduces risk but does not close the identity attack surface

MFA raises the cost of credential abuse, but it does not eliminate weak access behaviour. If users can bypass controls, reuse passwords, or obtain access through informal support processes, the assurance MFA provides becomes partial. The article’s Zero Trust point is important here: trust cannot be inferred from a successful login alone. Access must be continuously conditioned on the right identity, the right device and the right context, especially when the workforce is distributed.

Practical implication: pair MFA with contextual access policy, device verification and control enforcement at each access attempt.

How compliance pressure turned identity controls into operational requirements

CMMC and PSD2 show how authentication stopped being only a security preference and became a compliance requirement. CMMC level 3 requires MFA, while PSD2 requires 2FA for payments use cases. That matters because regulated identity controls must be implemented consistently, not selectively. When compliance, workforce change and remote access collide, organisations need identity governance that can prove policy adherence, not just deploy login technology.

Practical implication: align MFA enforcement, access policy and audit evidence so compliance obligations and security controls do not drift apart.

Threat narrative

Attacker objective: The attacker aims to gain durable access to user and enterprise systems despite authentication controls, then exploit that access for theft, disruption or broader compromise.

1. Entry begins when attackers exploit weak remote-access habits such as password reuse, temporary passwords or user workarounds.
2. Credential abuse follows when stolen or reused credentials bypass brittle authentication workflows and reach company systems.
3. Impact emerges as exposed accounts, regulated access failures and broad compromise events create financial, operational and reputational damage.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication is not identity governance: 2020 showed that MFA can raise assurance while leaving the access model untouched. Remote work forced organisations to rely on temporary passwords, remote support and user-driven recovery paths that still expose the identity plane. The lesson is that login security and access governance are different problems, and treating them as the same creates blind spots. Practitioners should separate authentication strength from lifecycle and access assurance.

Remote work created identity blast radius outside the office: The office network stopped being the centre of control once users worked from home on mixed-use devices and across less predictable networks. That shift widened the practical blast radius of every weak password, bypass path and recovery workflow. The important issue is not merely that the perimeter moved, but that identity decisions now happen in far more variable conditions. Practitioners need governance that follows the user, device and session, not the building.

Zero Trust became an identity discipline, not a slogan: The article’s Zero Trust reference is really about making access decisions verifiable every time. That means no implicit trust in a prior login, a familiar device or a temporary workaround. The identity programme must prove that access is continuously conditioned, not merely initially authenticated. Teams should measure whether their controls can stop a user from bypassing the intended path, not whether they issued an MFA token.

Compliance pressure pushed identity into the business continuity stack: CMMC and PSD2 show that identity controls were no longer optional security hygiene in regulated sectors. They became operational prerequisites for selling, transacting and maintaining access. That changes the IAM conversation from feature adoption to evidence production. Practitioners should expect regulators and counterparties to ask not just whether MFA exists, but whether it is consistently enforced across real workflows.

Access review processes still lagged the speed of modern compromise: The SolarWinds and FireEye reporting illustrates a broader gap between detection, review and remediation in distributed environments. If compromise can persist across agencies, governments and companies for months, then periodic reviews alone are too slow to contain exposure. The field needs tighter coupling between identity telemetry, enforcement and revocation. Practitioners should assume that delayed governance increases attacker dwell time.

What this signals

Remote work exposed a simple programme weakness: too many organisations still treated identity as a login problem instead of a lifecycle and access-governance problem. When access support, device trust and recovery workflows are inconsistent, MFA only narrows part of the attack path.

Identity trust debt: The longer an organisation leaves temporary passwords, user workarounds and device ambiguity in place, the more it accumulates control debt that attackers can exploit later. The practical response is to move trust decisions earlier in the access flow, where they can be enforced rather than assumed.

For practitioners

• Harden remote access recovery paths Remove ad hoc temporary-password workflows and replace them with controlled recovery processes that verify the device, the user and the reason for access before credentials are issued.
• Enforce MFA across all access paths Apply MFA consistently to remote access, privileged workflows and regulated transactions so users cannot bypass stronger controls through exceptions or legacy login paths.
• Verify device trust before granting access Require a defined device policy for remote workers and block access when posture, ownership or supportability cannot be established.
• Reduce password reuse and shared secrets Eliminate policies that rely on users memorising or reusing credentials and move toward stronger authentication flows that do not depend on user-managed password behaviour.

Key takeaways

• 2020 showed that remote work can outpace identity controls faster than policy teams expect, especially when access support processes remain informal.
• MFA improved authentication assurance, but the article makes clear that temporary passwords, device uncertainty and user circumvention still left room for attack.
• The practical lesson is to govern device trust, recovery paths and access enforcement together instead of treating MFA as a standalone fix.

Key terms

• Remote Access Recovery: The process used to restore a user's access when normal authentication fails. In this article's context, recovery is a security control, not just a support task, because temporary passwords and informal exception handling can become the easiest path around stronger identity controls.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
• Temporary Password: A one-time credential issued for initial access or recovery, then replaced by the user after first use. Temporary passwords are meant to be short-lived and tightly governed so they do not become permanent secrets or a lasting point of compromise.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.