Global authentication habits still favor passwords over passkeys

At a glance

What this is: Yubico’s survey shows that passwords and SMS still dominate authentication behaviour even as passkey familiarity and phishing concern rise in some markets.

Why it matters: Identity teams need to treat authentication as a governance problem, because inconsistent MFA coverage and weak user understanding leave both human and non-human access paths exposed to phishing and credential theft.

By the numbers:

• Yubico’s 2025 Global State of Authentication survey polled 18,000 employed adults across nine countries.
• 26% of respondents still believe a simple username and password is the most secure way to protect an account.
• 41% of respondents place their trust in vulnerable SMS-based authentication.
• 60% of respondents use usernames and passwords for personal accounts, and 56% do so for work accounts.

Context

Authentication habits still shape the attack surface because phishing, credential theft, and account takeover continue to exploit the weakest login method in use. When users trust passwords or SMS more than phishing-resistant controls, the control environment is already misaligned with current threat conditions.

Yubico’s survey is useful because it separates awareness from behaviour. The article shows that familiarity with passkeys is growing in some countries, but coverage remains uneven across personal and work accounts, and many organisations still tolerate inconsistent protection by role or device.

For IAM teams, the practical issue is not whether stronger options exist. It is whether policy, user education, and enforcement have caught up with the reality that identity compromise often starts with login friction that was accepted long after better options were available.

Key questions

Q: How should security teams roll out passkeys without creating support problems?

A: Start with recovery design, user communication, and help desk readiness. Passkeys usually fail at adoption when teams skip operational planning and treat the rollout as a simple login change. Define re-enrolment, backup authentication, and revocation steps before expansion, then stage deployment by user group and risk level.

Q: Why do password and SMS based authentication still create so much risk for businesses and consumers?

A: Password and SMS based authentication remain risky because they are easy to phish, reuse, intercept, or social engineer. The article shows many users still trust these methods and keep using them at work and home, even though attackers commonly start with stolen credentials. When authentication depends on phishable factors, compromise becomes a matter of time rather than sophistication.

Q: What signs show that authentication policy is too inconsistent?

A: Look for different rules by role, app, or device, plus exceptions that have become permanent. If one team can use phishing-resistant authentication while another still relies on passwords or SMS, the programme is not enforcing a single security standard.

Q: How should security teams decide between hardware security keys and passkeys for different user groups?

A: Use hardware security keys for high risk roles, regulated environments, and shared or unmanaged devices where physical possession matters. Use passkeys for everyday workforce and consumer logins where convenience, cross device access, and lower user friction are priorities. Many organisations deploy both, reserving hardware keys for administrators and passkeys for broader passwordless adoption.

Technical breakdown

Why passwords and SMS keep failing as primary authentication

Passwords and SMS remain popular because they are familiar and easy to deploy, not because they are resilient. Both depend on secrets that users can reuse, guess, phish, or intercept, and neither binds authentication strongly to the device or the legitimate user in the way phishing-resistant methods do. In practice, that leaves the organisation exposed to credential stuffing, consent phishing, and social engineering that targets the human decision layer rather than the protocol alone. The article’s data shows that outdated methods remain embedded in both work and personal usage, which means the weakest path is still often the default path.

Practical implication: Replace password-first assumptions with phishing-resistant authentication for high-risk and routine access alike.

Passkeys, hardware security keys, and phishing-resistant MFA

Passkeys and hardware-backed security keys change the trust model by using cryptographic credentials that are harder to phish and easier to bind to the intended device and account. That does not eliminate all identity risk, but it removes the shared-secret pattern that attackers routinely exploit through fake login prompts and adversary-in-the-middle attacks. The article shows growing familiarity in some regions, but also large awareness gaps, which means adoption is being slowed by user education and rollout consistency rather than by the technology itself. For enterprise identity programmes, phishing resistance becomes a control objective, not a UX feature.

Practical implication: Prioritise hardware-backed phishing-resistant MFA for administrators, remote access, and any account with meaningful business impact.

Why inconsistent authentication policy creates avoidable exposure

Authentication becomes weak when organisations apply different standards by role, account type, or device trust without a clear risk rationale. That fragmentation creates multiple entry points for attackers and undermines the assumption that one strong control elsewhere compensates for a weak one here. The survey’s cross-country differences also show that adoption patterns vary by local practice, which means global policy without local execution will leave gaps. The governance issue is not only whether MFA exists, but whether it is enforced across all apps, all users, and all access paths that matter.

Practical implication: Standardise authentication policy across applications and roles, then measure exceptions as risk debt rather than convenience.

Threat narrative

Attacker objective: The attacker wants to turn one phished login into authenticated access that can be reused for theft, impersonation, or lateral movement across connected accounts.

1. Entry begins when a user accepts a phishing message or credential prompt and enters a reusable secret into a fake or coerced login flow.
2. Credential access follows when the attacker captures the password, SMS code, or session-linked token and reuses it against the real service.
3. Escalation occurs when the stolen credential opens access to work systems, personal accounts, or downstream services protected by the same weak authentication pattern.
4. Impact is account takeover, with the attacker able to impersonate the user, harvest additional data, or pivot into other services that trusted the compromised identity.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
• Solana web3.js npm compromise 2024: A phished maintainer's npm access let attackers publish two @solana/web3.js versions that stole private keys from bots and apps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwords are no longer a defensible default for high-value access: They persist because they are easy to deploy, not because they align with current attack methods. When phishing, credential stuffing, and AI-assisted social engineering dominate the threat environment, password dependence becomes a governance failure, not a user preference. Organisations that still treat password usage as acceptable baseline security are managing yesterday’s compromise model.

Passkey adoption is primarily an education and policy problem, not a technology problem: The survey shows awareness gaps even where stronger authentication is available and familiar to some users. That means the blocker is often rollout design, communication, and inconsistent enforcement rather than missing capability. The implication is that identity programmes must close the gap between what the platform can do and what users are actually guided to use.

Authentication variance by role creates predictable weak links: Any programme that allows different login standards for different populations is building uneven assurance into the identity stack. Attackers do not need every account to be weak, only one path that remains phishable or interceptable. The practical conclusion is that identity policy should be measured by weakest-enforced path, not by strongest available option.

Phishing-resistant MFA is becoming the minimum viable control for exposed identities: The more users work across personal and corporate contexts, the more a shared-secret model fails under real-world behaviour. Hardware-backed keys and passkeys reduce exposure to the human error that phishing depends on. For IAM and security architects, the security question is shifting from whether to adopt phishing-resistant methods to where they are still not mandatory.

Identity governance now spans human habits and machine trust assumptions: The same weak authentication patterns that expose employees also create collateral risk for service accounts, delegated access, and other non-human identities that inherit human login choices. Stronger authentication is therefore not only a workforce issue but a control plane issue across the whole identity estate. The programme implication is to align human login policy with the trust model used for all privileged access.

What this signals

Identity teams should treat authentication as a policy system, not a login preference: Users will continue to choose familiar methods unless the organisation removes ambiguity about what is required. That means stronger authentication has to be enforced as the default, not offered as an option for the already security-conscious.

Passkey adoption will stall where recovery and exception handling stay password-shaped: The most common failure mode is not the passkey itself but the surrounding process. If reset, enrolment, or backup access still depends on the same weak trust model, the migration only shifts risk instead of reducing it.

For practitioners

• Enforce phishing-resistant MFA for high-value access Require passkeys or hardware security keys for administrators, remote access, and any workflow that can reach sensitive systems or data.
• Remove password-only fallback paths Audit applications, VPNs, and legacy SSO routes to find where passwords or SMS remain accepted as a primary or recovery path.
• Standardise authentication policy across roles Apply one minimum authentication standard across user groups, then treat exceptions as temporary risk decisions with explicit ownership.
• Build passkey education into rollout plans Explain to employees why passkeys exist, how they reduce phishing exposure, and where they should replace older login methods.

Key takeaways

• Passwords and SMS still dominate too many authentication journeys, which keeps phishing and credential theft effective against both work and personal accounts.
• The survey points to a governance problem as much as a technology gap, because inconsistent policy and low user understanding slow adoption of stronger methods.
• Phishing-resistant MFA and passkeys reduce the attack surface, but they only deliver value when organisations enforce them consistently and support them properly.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Legacy authentication: Older login or protocol methods that remain in place for compatibility even after stronger controls exist. They often preserve weaker trust assumptions, which makes them attractive to attackers and difficult to defend if they are not tightly scoped and eventually retired.
• Authentication Policy Enforcement: Authentication policy enforcement is the act of making approved login methods mandatory and preventing weaker alternatives from being used. In practice, it includes configuration changes, user lifecycle controls, monitoring, and recovery design so that the intended control remains in effect across all covered accounts.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.