Finance identity security gaps show where MFA and access fail

At a glance

What this is: This report examines where finance organisations still struggle with access management, MFA, passwordless adoption, and shared account control, showing that identity debt is the recurring problem rather than a single broken control.

Why it matters: It matters because finance teams often treat IAM, PAM, and NHI controls as separate workstreams, when the report suggests the real failure is governance consistency across the whole identity estate.

Context

Finance identity security is often evaluated as a set of separate control programmes, but the more important issue is whether those controls work together under real operating conditions. In this report, access management, MFA, passwordless adoption, and shared account governance are treated as connected symptoms of a broader identity debt problem.

For IAM leaders, PAM teams, and security architects in financial services, the practical question is not whether these controls exist in policy. It is whether they are still relied on in places where shared accounts, remote access, and legacy authentication habits undermine them.

Key questions

Q: What breaks when shared accounts are still used for sensitive finance access?

A: Shared accounts break attribution, recertification, and incident investigation because the identity performing the action is no longer tied to a specific person or owner. In finance, that creates a governance blind spot where privileged activity can be authorised in theory but cannot be reliably reviewed or challenged in practice.

Q: Why do MFA deployments still leave organisations exposed to identity risk?

A: Because MFA only proves an identity at sign-in, it does not determine whether the identity should retain access afterward. If accounts are over-provisioned, offboarding is slow, or privileged roles are not recertified, an attacker or insider can still work within legitimate access. The remaining risk is governance failure, not factor failure.

Q: How do organisations know whether passwordless access is actually improving security?

A: Look for reduced password dependence, fewer lockouts, lower help desk reset volume, and stronger control over high-risk workflows such as shared workstation access and privileged clinical systems. If user friction drops while identity assurance rises, the programme is moving in the right direction.

Q: When should finance teams prioritise access governance over new authentication methods?

A: Teams should prioritise access governance first when shared accounts, unclear ownership, or stale entitlements are already present. In that situation, new authentication methods will not repair the governance gap. Fixing who has access, why they have it, and when it should end produces more durable risk reduction.

Technical breakdown

Why identity debt persists in finance programmes

Identity debt is the gap between the access model organisations think they operate and the control model users actually experience. In finance, that gap often appears when MFA is unevenly deployed, passwordless adoption stalls, and account ownership becomes blurred across teams and third parties. The result is not a single technical weakness but a governance mismatch: policy assumes modern authentication and clear accountability, while the environment still tolerates exceptions, workarounds, and shared access patterns. That mismatch makes control coverage look better than it is.

Practical implication: teams should map where policy assumptions diverge from real authentication and access behaviour.

How shared accounts weaken access accountability

Shared accounts remove the link between identity and action, which makes investigation, recertification, and privilege review far less meaningful. In regulated environments, that breaks the basic assumption that access can be tied to a person or a service owner with a clear lifecycle. The issue is not merely that shared accounts are hard to monitor. It is that they collapse accountability, so a control framework built around ownership, review, and attribution no longer has a reliable object to govern. That is especially problematic where multiple teams depend on the same high-risk credentials.

Practical implication: remove shared accounts from privileged and sensitive workflows wherever ownership cannot be assigned cleanly.

Why MFA alone does not close finance access risk

MFA reduces password-based compromise, but it does not fix broken access design, stale entitlements, or overbroad privilege. In finance environments, MFA can become a compensating control that masks deeper issues such as poor access governance, weak joiner-mover-leaver discipline, and unmanaged exceptions for service or shared access. Passwordless can improve the authentication layer, but the report’s broader message is that authentication strength and access governance are not the same thing. Stronger login assurance does not automatically produce better authorization or better lifecycle control.

Practical implication: treat MFA and passwordless as control layers, not substitutes for access governance.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity debt is now a finance governance problem, not just an authentication problem. The report points to a sector where access management, MFA, passwordless adoption, and shared account control drift apart in practice. That is not a collection of isolated gaps. It shows that finance programmes can have modern controls on the books while still operating on legacy identity assumptions in production.

Shared accounts are the clearest example of accountability collapse in finance. When multiple people use the same credential, recertification becomes shallow, forensic attribution becomes unreliable, and privileged access governance loses its most important unit of control. The named concept here is accountability collapse through shared access: ownership exists in policy but not in practice, so the control no longer governs a real identity relationship.

MFA weakness is usually a symptom of broader access design failure. If the environment still relies on legacy protocols, exceptions, or shared administrative paths, then stronger authentication only protects the front door. The deeper issue is that finance organisations often treat authentication and authorization as separate projects when the governance failure spans both. Practitioners should read MFA findings as an operating model signal, not just a login issue.

Passwordless adoption only matters when it is attached to lifecycle governance. Replacing passwords without fixing joiner-mover-leaver discipline, privileged account ownership, and exception handling can simply modernise a broken model. Finance teams need to view passwordless as one layer in a wider identity control system, not as the endpoint of identity modernisation.

The finance sector is exposing a broader truth about identity programmes: control coverage is not control effectiveness. Many teams can point to deployed tools, but fewer can show consistent enforcement across humans, service access, and privileged workflows. The practical conclusion is that governance maturity now depends on how well organisations eliminate exceptions and bind every access path to a defensible owner.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

The finance sector is a useful reminder that identity programmes fail most often at the seams between controls. When authentication, access ownership, and lifecycle review are managed separately, the organisation can look compliant while still carrying identity debt in the places that matter most.

Accountability collapse through shared access: this is the pattern finance teams should watch for when multiple users or support functions depend on the same credential. Once ownership becomes ambiguous, access review loses force and PAM loses traceability.

The practical signal for programme leaders is not whether a control exists, but whether exceptions have become normal operating procedure. Where exceptions become habitual, the control has shifted from governance to decoration.

For practitioners

• Inventory shared accounts across privileged workflows Identify every shared account used in finance operations, then classify each by owner, purpose, and whether the account can be replaced with named access or delegated service identity.
• Test MFA coverage against real access paths Verify that MFA is enforced for the access paths staff actually use, including remote access, admin consoles, and exception routes that often bypass standard policy.
• Separate authentication uplift from authorization cleanup Treat passwordless adoption as a distinct workstream from entitlement review, privileged access cleanup, and recertification so stronger login assurance does not hide stale access.
• Close exception pathways for privileged access Document every standing exception for admin or sensitive access, then retire any exception that cannot be tied to a clear business owner and expiry condition.

Key takeaways

• Finance identity security problems often reflect identity debt across governance, not a single broken control or missing feature.
• Shared accounts, uneven MFA coverage, and weak passwordless adoption point to a control environment where accountability and access ownership no longer line up cleanly.
• The most durable response is to align authentication improvements with entitlement cleanup, lifecycle discipline, and removal of shared privileged access.

Key terms

• Identity Debt: Identity debt is the accumulation of unowned, over-permissioned, or poorly governed non-human identities that security teams cannot cleanly inventory or retire. It usually grows when experimentation outruns access governance, leaving service accounts and tokens active long after their original purpose has passed.
• Shared Account: An account used by more than one person or process, often for convenience in operational environments. In identity governance, shared accounts weaken attribution, complicate auditing and make it difficult to prove who performed an action during production or maintenance activity.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Access Exception: An access exception is a temporary deviation from standard policy that allows a tool, identity, or workflow to operate outside the normal control model. Exceptions are acceptable only when they are owned, time-bounded, and reviewed, otherwise they become identity debt that weakens governance over time.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity security programme, it is worth exploring.