2020 showed identity security gaps widening under remote work

At a glance

What this is: Axiad’s 2020 review says remote work, weak passwords, uneven MFA adoption, and major breach activity exposed identity control gaps that many organisations were already carrying.

Why it matters: This matters because IAM teams had to secure a faster shift to remote access without relying on passwords or assuming MFA alone would close the gap.

By the numbers:

• At the beginning of 2020, more than half of CIOs expected an increase in remote workers.
• Only 57% of businesses were utilizing MFA by last fall.
• Ninety-one percent of people understand that repurposing passwords is a security risk, but 66% still do so.

Context

Axiad’s review of 2020 centres on a simple governance problem: identity controls built around trusted office access struggled when work moved outside the perimeter. Remote access, password reuse, and inconsistent MFA adoption became more visible at the same time as attackers increased pressure on users and authentication workflows.

The article treats 2020 as a stress test for identity security programmes. It links remote work, phishing, credential theft, ransomware, and supply chain compromise to a wider lesson for IAM and PAM teams: authentication success is not the same as trustworthy access.

For identity leaders, the key question is not whether users can log in, but whether the access path remains defensible when the user, device, and network are all outside the managed environment. That is a programme design issue, not just a login issue.

Key questions

Q: Why does remote work increase identity risk even when MFA is in place?

A: Remote work increases identity risk because MFA does not remove the pressure created by more devices, more apps, and more credentials. If access is fragmented or hard to use, users look for shortcuts. The real risk is not only authentication weakness, but the operational sprawl that surrounds it.

Q: What breaks when MFA is not native to the identity platform?

A: When MFA is not native to the identity platform, enforcement often becomes uneven across applications, user groups, and access paths. That inconsistency creates audit gaps and leaves privileged or remote sessions exposed to credential theft. Security teams then have to prove control effectiveness across multiple layers instead of one authoritative policy plane.

Q: How do security teams know whether zero-trust remote access is actually working in practice?

A: Security teams should look for evidence that users only reach approved resources, sessions are brokered through controlled gateways, and access decisions are enforced consistently across cloud and on-prem systems. Strong signals include reduced reliance on VPNs, clearer session logs, and fewer over-privileged connections. If users can reach unrelated systems easily, the zero-trust model is not being applied effectively.

Q: Why do phishing and credential theft still matter in zero trust programmes?

A: Because zero trust is about continuous verification, not a one-time sign-in. Phishing and credential theft remain effective when teams assume authentication success equals safety. The programme has to limit what an authenticated identity can do next, especially in remote environments.

Technical breakdown

Why remote work exposed trust assumptions in access control

Remote work changed the operating context of identity controls. When users connect from unmanaged or less predictable networks, the programme can no longer rely on location, device familiarity, or office-bound support flows as informal assurance signals. Password resets, temporary passwords, and ad hoc login workarounds become especially risky because they create alternate access paths that are easier to abuse than the intended one. The article’s core point is that a remote workforce forces identity teams to validate the access path itself, not just the username and password pair.

Practical implication: treat remote access as a governance problem for every login path, including password recovery and temporary credential issuance.

Why MFA reduces risk but does not end identity compromise

MFA improves authentication strength, but it does not remove the behavioural and process failures that let users bypass controls. The article notes that organisations can become complacent once MFA exists, even though people still reuse passwords, fall for phishing, or use workarounds that defeat the intended control. In practice, MFA is a gate, not a complete identity architecture. If access policies, device trust, recovery flows, and user behaviour are weak, the organisation still has a viable attack surface after the second factor is in place.

Practical implication: pair MFA with policy, device verification, and recovery controls so authentication strength is not undermined elsewhere.

How supply chain compromise and credential theft reach beyond the login event

The article uses SolarWinds, FireEye, phishing, and credential theft to show that identity compromise is often the front door for broader intrusion. Once an attacker obtains trusted access or rides a trusted software path, the issue is no longer just authentication failure. It becomes a question of how much trust the organisation has granted to identities, vendors, and sessions after the first successful interaction. That is why the article connects zero trust thinking to identity security: access must remain continuously evaluated instead of assumed safe after entry.

Practical implication: design for continuous verification and limit trust expansion after initial authentication or third-party access.

Threat narrative

Attacker objective: The attacker’s objective is to turn a valid access path into durable reach across users, systems, or trusted supply chains.

1. Entry occurs through phishing, credential theft, or trusted supply chain compromise that gives attackers a foothold in the identity plane.
2. Escalation follows when reused passwords, temporary passwords, or incomplete MFA enforcement let the attacker move through additional accounts or services.
3. Impact emerges as attackers expose personal data, disrupt operations, or extend access into broader enterprise and government environments, as seen in the year’s major incidents.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Remote work turned identity assurance into a continuous control problem. The article shows that office-centric assumptions no longer held once work moved to home networks, personal devices, and emergency login paths. That changes the identity programme from proving who a user is once to proving that access remains trustworthy across changing conditions. For practitioners, the lesson is to treat remote access as a governed journey, not a single authentication event.

MFA reduced one class of risk but did not neutralise bypass behaviour. Axiad’s review is clear that organisations with MFA still faced user workarounds, password reuse, and compromised recovery flows. That means MFA must be viewed as one control in a wider access assurance model, not as the finish line. The practitioner takeaway is that authentication strength only matters if the surrounding identity processes do not reintroduce weakness.

Identity security in 2020 exposed the limits of perimeter-era thinking. Phishing, credential theft, ransomware, and SolarWinds-style compromise all show that trust can enter through many channels, not just direct login abuse. The governance challenge is that access review models and authentication design often assume a stable office context and a predictable trust boundary. Practitioners should rework their identity assumptions around continuous verification and constrained trust expansion.

Zero trust became a practical identity principle, not a slogan. The article’s framing makes clear that security teams cannot assume a user is safe because a password or factor was satisfied once. The important shift is from trusting the successful login to governing every subsequent step, especially in remote and hybrid access patterns. For identity leaders, that means policy, device assurance, and session governance must move together.

Remote work widened the identity attack surface faster than many programmes could adapt. The most useful concept here is an identity attack surface expansion, where every new recovery flow, device exception, and remote access workaround increases exposure. That is not merely a security trend. It is a governance signal that access design, user support, and authentication policy now need to be managed as one system. Practitioners should map where convenience has quietly become risk.

What this signals

Identity attack surface expansion: remote work, recovery flows, and temporary credential practices expanded the number of places where trust could fail. Programme owners should review login support paths with the same scrutiny they apply to primary authentication.

The article is a reminder that authentication strength and governance quality are separate problems. A mature identity programme must reduce password dependence, enforce MFA consistently, and close the support-workaround gap that remote work tends to create.

For practitioners

• Tighten temporary credential handling Eliminate email-based temporary passwords where possible and require stronger recovery paths for remote users. If temporary credentials must exist, make their issuance, scope, and expiry tightly controlled.
• Reassess MFA coverage across access paths Check not only whether MFA exists, but whether it is enforced for all remote access routes, privileged access, and account recovery flows. The control fails when exceptions become the norm.
• Verify device trust before access is granted Define which devices may connect to corporate systems and require verification for company-owned and personal devices alike. Remote work makes device policy part of identity assurance, not an endpoint side issue.
• Reduce password reuse exposure Remove reliance on reusable passwords wherever practical and prioritise stronger authentication methods that do not depend on users remembering or re-entering shared secrets.
• Apply continuous trust evaluation Treat successful authentication as the start of governance, not the end. Constrain session trust so later actions are still validated when the access path changes or comes from a risky context.

Key takeaways

• Remote work in 2020 exposed how quickly identity assumptions break when users operate outside the office perimeter.
• The year’s major incidents reinforced that phishing, credential theft, ransomware, and supply chain compromise can all exploit weak identity governance.
• Security teams need controls that govern recovery paths, MFA enforcement, and trust expansion after sign-in, not just the authentication event itself.

Key terms

• Remote Access Governance: Remote access governance is the set of policies and controls that determine who can connect, under what conditions, and with what level of oversight. In practice, it covers authentication, session monitoring, approval workflows, logging, and the separation of employee, vendor, and privileged access paths.
• Identity Attack Surface: Identity attack surface is the total set of accounts, tokens, login endpoints, trust paths, and supporting systems that can be probed for access. For password spraying, the risk grows with every externally reachable authentication path and every dormant or weakly protected identity.
• Authentication bypass: An authentication bypass is a flaw that lets a requester reach protected functionality without completing the intended identity check. In practice, it turns the application’s login boundary into a broken assumption, so any exposure path in front of that application becomes materially more important.
• Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.