Hybrid authentication environments still need password risk reduction

At a glance

What this is: This is Enzoic’s case that hybrid authentication is now the norm, and that password risk remains the dominant exposure even where passkeys have been deployed.

Why it matters: IAM and security teams need to treat passwords as the live attack surface inside mixed authentication estates, because modernization does not remove legacy paths to valid access.

By the numbers:

• 93% of users in workforce environments still used passwords as of January 2025, according to Okta research cited by Enzoic.
• 56% of organizations still kept passwords as an authentication method even after deploying passkeys, according to Enzoic’s analysis of Okta research.

Context

Hybrid authentication means an enterprise runs passwords and modern methods such as passkeys side by side across different applications and access paths. Enzoic’s point is that this is not a temporary transition state for most organisations, because legacy applications, Active Directory, VPNs, third-party SaaS, customer portals, and privileged workflows still depend on passwords.

The governance gap is that many identity programmes treat passkey rollout as a replacement project when the real control problem is risk reduction in the password layer that remains. In mixed estates, attackers do not need to defeat the newest authenticator if they can still use exposed credentials, reused passwords, or account recovery paths that trust them.

Key questions

Q: What should identity teams do when passkeys coexist with password-era workflows?

A: Decide which legacy flows will be retired, which will be time-limited, and which will be prohibited entirely. Then align security, support, and product ownership so the default journey favours passkeys and the exception paths do not reintroduce phishable access.

Q: Why do exposed passwords remain dangerous even after modern authentication is deployed?

A: Because exposure often happens upstream of the login event. A credential can be stolen, reused, or leaked and still remain valid in legacy systems, recovery flows, or privileged access paths. That means the sign-in may look legitimate while the identity risk began much earlier, which is why screening and revocation matter as much as authentication strength.

Q: Why do password controls fail in hybrid environments?

A: They fail when coverage stops at the directory or the newest identity platform. Legacy applications, integrations, service accounts, and recovery paths often keep using passwords, so the organisation cannot show consistent enforcement across the full estate.

Q: How do organisations reduce the blast radius of remaining password access?

A: By limiting password-based access to the smallest possible set of systems and removing it from high-risk paths such as administrative workflows, remote access, and recovery processes where stronger methods are available. The goal is not perfection, but shrinking the number of trusted password-bearing routes attackers can exploit.

Technical breakdown

Why passwords remain the dominant residual control point

Hybrid authentication estates keep multiple trust models active at once. A password may still govern administrative access, legacy line-of-business systems, remote access, customer portals, or fallback recovery flows even after passkeys are introduced elsewhere. That means the security profile is defined by the weakest remaining password-dependent path, not by the most modern sign-in method. The article’s core technical claim is that selective modernization concentrates risk rather than eliminating it, because attackers only need one valid password-bearing path to reach high-value systems.

Practical implication: inventory every password-dependent pathway, not just user-facing sign-in, and rank it by downstream privilege.

Why credential exposure sits upstream of authentication

The article draws a clear distinction between password compromise and login events. Credentials are often exposed before the authentication attempt, through breach data, reuse, infostealer logs, phishing kits, or help desk resets. Once exposed, the same credential may remain valid across multiple systems, which is why the login can look legitimate even when the risk began much earlier. This is an NHI lifecycle problem as much as an authentication problem, because exposed secrets continue to exist until they are screened, reset, or invalidated.

Why continuous credential screening beats static password policy

Length and complexity rules improve baseline hygiene, but they do not answer the key question in hybrid environments: has this password already appeared in breach data or reuse patterns? Static policy can produce compliant passwords that are still unsafe. Continuous screening changes the control from character composition to exposure status, which is more relevant where password use persists across Active Directory, workforce identity systems, and account recovery workflows. The article’s security logic is that attackers exploit trust in valid credentials, so the control has to reject known-bad secrets rather than merely shape them.

Practical implication: screen passwords at creation, reset, and ongoing monitoring stages so exposed credentials are blocked before they become usable access.

Threat narrative

Attacker objective: The attacker’s objective is to obtain valid access through the password layer that still exists and use it to reach high-value enterprise systems.

1. Entry occurs when an attacker obtains exposed credentials through breach data, phishing kits, infostealer logs, credential reuse, or help desk reset abuse.
2. Credential access succeeds because the stolen or reused password is still trusted by at least one password-dependent system in the hybrid estate.
3. Impact follows when the attacker uses valid access to reach legacy applications, remote access, privileged workflows, or customer-facing portals without triggering an obvious exploit chain.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid authentication is now a permanent governance state, not a transition phase. Most enterprises will keep passwords alive across legacy, vendor, and recovery paths even after passkeys are deployed elsewhere. That means identity programmes must govern coexistence, not chase an imagined cutover date. The practitioner conclusion is simple: manage the residual password estate as a first-class risk domain.

Credential exposure, not authentication failure, is the real upstream problem. The article correctly separates where risk begins from where it becomes visible. Once a password is circulating in breach data or reuse ecosystems, the login can still look legitimate, which is why conventional authentication controls miss the earliest and most important warning sign. The implication is that identity defence has to start before the sign-in event.

Continuous screening is a governance control, not just a hygiene control. Static complexity rules can improve syntax while leaving exposure untouched. In hybrid estates, the higher-value control is knowing whether a password has already been seen outside the organisation and preventing its reuse across workforce, customer, and administrative flows. That makes password screening part of lifecycle governance, not merely an authentication add-on.

Identity blast radius is determined by the password paths that remain. As modern authenticators expand, attackers concentrate on the systems that still trust passwords, especially high-privilege and recovery workflows. That creates a concentrated blast radius where legacy trust assumptions persist longest. The practitioner conclusion is to map where password trust still reaches privileged assets and treat those paths as the primary containment boundary.

Passwords and passkeys coexist, but the security model cannot treat them as equal. Passkeys reduce exposure where they are enforced, yet they do not neutralise the risk carried by systems that still accept passwords. Governance should therefore be asymmetric: strengthen the remaining password layer more aggressively than the modern layer is celebrated. The conclusion is to prioritise the control surface attackers can still exploit today.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Password Security and Password Manager Guide

What this signals

Identity programmes should stop treating passkey rollout as a finish line. Hybrid estates keep password risk alive wherever legacy applications, recovery flows, and administrative access still trust them. The practical shift is from authentication modernisation to residual credential risk management, with password exposure treated as an active control issue rather than a legacy inconvenience.

Credential screening should sit closer to issuance than to incident response. If a password has already appeared in breach data, the organisation is already behind. The more effective programme design is to screen at creation, at reset, and continuously after deployment, so the password layer is governed before it becomes a valid access path.

Residual password trust creates a measurable identity blast radius. In mixed estates, the systems that still accept passwords become the easiest place for attackers to land and move toward privileged workflows. The governance question is not whether passwords exist, but which business-critical paths still depend on them and how far those paths can reach.

For practitioners

• Inventory every password-dependent access path Map legacy applications, Active Directory, VPN, customer portals, administrative workflows, and recovery flows that still trust passwords. Prioritise the paths that lead to privileged or externally reachable systems.
• Screen credentials at issuance and reset Block known-bad passwords when users create or reset them, and extend the same screening logic to privileged and recovery workflows where password trust remains.
• Monitor for exposed credentials continuously Use ongoing checks for breach exposure, reuse, and infostealer-derived credential risk so a password is not treated as safe simply because it passed a one-time policy check.
• Reduce the remaining password blast radius Constrain password-based access to the smallest possible set of systems, then remove direct password trust from high-risk administrative and remote access paths where passkeys or stronger controls are available.
• Treat recovery workflows as high-risk identity paths Apply the same scrutiny to account recovery and help desk reset processes as to primary sign-in, because those paths often preserve password trust after modernization.

Key takeaways

• Hybrid authentication leaves a large residual attack surface because many enterprise systems still rely on passwords even after passkeys are introduced.
• The main risk is not password complexity alone but credential exposure, reuse, and recovery paths that continue to trust previously compromised secrets.
• Reducing that risk requires continuous credential screening, tighter control of legacy password paths, and a narrower blast radius for any access that still depends on passwords.

Key terms

• Hybrid Authentication: Hybrid authentication is an environment where passwordless methods, passwords and MFA all coexist during migration or by design. It creates governance complexity because assurance, fallback rules and user experience must remain consistent across different applications and risk levels.
• Credential exposure: The condition where a secret, token, key, or certificate becomes visible to a system or user that should not have direct access to it. In AI-assisted workflows, exposure can happen through prompts, files, or agent-accessible directories, which makes containment and runtime gating essential.
• Password Layer: The part of an identity estate that still depends on passwords for access, even when newer methods exist elsewhere. This layer often includes legacy applications, remote access, administrative workflows, and account recovery flows, making it the most important residual control surface in a hybrid environment.
• Continuous credential screening: Continuous credential screening is the practice of checking credentials after issuance for signs of external exposure, reuse, or compromise. It extends security beyond reset time and helps organisations revoke or challenge access before a stolen secret becomes persistent access.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.