Password-only authentication is still the weak link in secure access

At a glance

What this is: This is a 1Kosmos article arguing that password-only authentication is still too weak for secure access because passwords are easy to steal, reuse and phish.

Why it matters: IAM teams need stronger authentication because password reuse and phishing create preventable access exposure across human accounts, cloud systems and downstream authorisation decisions.

By the numbers:

• Up to 45% of users use the same password across at least 2 or more accounts, according to 1Kosmos.
• 20% of users say most of their accounts use the same password, according to 1Kosmos.
• 6% of users say they use the same password for all accounts, according to 1Kosmos.

Context

Password-only authentication is a trust shortcut, not a durable security control. When one secret is reused across multiple accounts, a single compromise can create a wider access path than the original login event.

This matters to IAM because authentication is only the first control in the access chain. If identity proof is weak at sign-in, downstream authorisation, session control and access governance all inherit that weakness.

The article focuses on human authentication patterns, but the governance lesson extends to any programme that still treats one factor as a stable indicator of user legitimacy.

Key questions

Q: What breaks when organisations rely only on authentication to secure access?

A: Authentication alone fails when valid credentials are stolen, replayed, or socially engineered. Once an attacker has a legitimate identity path, they can often move inside the environment without triggering perimeter controls. Security teams need behavioural detection, device context, and runtime response so access confidence can change after login rather than remaining fixed.

Q: Why do reused passwords create such a large identity risk?

A: Reused passwords turn one disclosure into many possible logins. Attackers can test the same secret against email, SaaS, admin consoles, and personal services until they find something that still works. The problem is multiplicative because every reused credential expands the attacker’s reach without requiring a new break-in.

Q: How do organisations know whether their MFA strategy is actually reducing risk?

A: Look beyond factor count and measure phishing resistance, step-up coverage, and recovery abuse. Passkeys and hardware keys are stronger than SMS or basic push because they bind authentication to origin, while number matching and adaptive challenges reduce fatigue attacks. If recovery paths remain weak, MFA may still be bypassed.

Q: Why do organisations struggle to move from passwords to passwordless access in practice?

A: The main blockers are integration complexity, technical debt, and user acceptance, especially in environments with multiple authentication vendors and varied workflows. Passwordless fails when it is treated as a single login method rather than an access programme. Teams need consistent policy, broad authenticator support, and a rollout plan that reflects operational reality, not idealised architecture.

Technical breakdown

Why password reuse turns one compromise into many

Passwords are attractive to attackers because they are easy to capture through phishing, database theft, credential stuffing and social engineering. Once a password is reused across services, compromise of one account can become a reusable entry point into others, even when the original incident was outside the organisation. That makes the password itself a portability risk, not just an authentication factor. The control problem is not only secrecy, but persistence across systems and contexts. Practical implication: treat password reuse as an account linkage issue, not just a user behaviour issue, and reduce the number of places where a stolen secret remains valid.

Practical implication: reduce the number of places where a stolen secret remains valid.

How MFA changes the authentication trust model

Multi-factor authentication adds a second or third proof signal, typically something the user knows, has or is. That shifts authentication away from a single shared secret and makes theft of one factor less useful on its own. But MFA is not a universal fix if the second factor can be socially engineered, intercepted or reset through weak recovery flows. The security value comes from breaking the attacker’s assumption that one stolen secret is enough to complete sign-in. Practical implication: evaluate MFA as a layered trust model, not as a checkbox replacement for passwords.

Practical implication: evaluate MFA as a layered trust model, not as a checkbox replacement for passwords.

Why passwordless access changes the attack surface

Passwordless authentication removes the password as a standing secret, which cuts off an entire class of reuse, guessing and theft attacks. It does not eliminate identity risk, because the remaining factors still need secure enrollment, device binding and recovery controls. But it does change the nature of the compromise path: attackers can no longer simply harvest a password and reuse it elsewhere. For IAM programmes, that shifts attention from password policy to identity proofing, phishing resistance and recovery governance. Practical implication: move the control discussion from password complexity to how users are enrolled, verified and recovered.

Practical implication: move the control discussion from password complexity to how users are enrolled, verified and recovered.

Threat narrative

Attacker objective: The attacker wants to turn one compromised password into broader unauthorised access across multiple accounts and systems.

1. Entry occurs when an attacker obtains a password through phishing, reuse or theft from a credential store.
2. Escalation follows when the same password unlocks additional accounts or services because users reused it elsewhere.
3. Impact is unauthorised access to systems and data that were assumed to be protected by password-only authentication.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password-only authentication is a single point of trust failure. When organisations treat one secret as proof of identity, they assume that the secret will stay private and unique across contexts. That assumption does not survive modern phishing, credential theft or reuse patterns. The practical conclusion is that password-only access is a brittle control model, not a stable authentication strategy.

Password reuse turns account compromise into identity sprawl. The article’s usage figures show that reuse is not an edge case, it is a common user behaviour. Once a password is shared across accounts, identity governance loses the ability to contain the blast radius of one stolen credential. IAM programmes should read this as a signal that credential controls and user behaviour cannot be managed separately.

Authentication quality now determines authorisation risk. If the login step is weak, every downstream access decision inherits that weakness, including cloud access, privileged access and application session trust. That makes secure authentication a governance issue, not just a front-door security issue. Organisations that still rely on passwords as their primary trust signal are managing authorisation with an unstable input.

Passwordless design reframes access from secret protection to identity proofing. Removing the password shifts the problem to stronger enrollment, device-bound verification and recovery controls. That is a better governance trade-off because it reduces the value of stolen credentials and narrows the set of reusable authentication artefacts. The practitioner takeaway is to measure access trust by how it is proved, not by how familiar the login flow feels.

Phishing resistance is now a baseline authentication requirement. The article describes MFA bypass and password theft as active attack patterns, which means IAM teams cannot treat them as theoretical risks. Authentication programmes should be evaluated on whether they resist real attacker workflows, not whether they satisfy a policy statement. The discipline has moved from password management to compromise-resistant access design.

What this signals

Password-only login is now a governance problem, not a convenience trade-off. The article’s core message is that a single shared secret cannot carry the assurance burden for modern access programmes. IAM teams should expect pressure to replace password-centric flows with stronger proofing methods wherever the account value justifies the change.

Passwordless adoption is best judged by what it removes from the attack path. The real gain is not cleaner user experience, but the removal of a reusable secret that attackers can phish, buy or replay. That changes the identity control conversation from managing password hygiene to managing enrollment and recovery trust.

Authentication design now sets the ceiling for access security. If sign-in can be bypassed through recovery or stolen credentials, downstream controls inherit a compromised identity. Practitioners should review whether their current authentication model still assumes a level of password trust that attackers no longer need to earn.

For practitioners

• Implement phishing-resistant authentication Prioritise authentication methods that do not depend on a reusable password as the main proof of identity. Focus on reducing reliance on shared secrets for users who access sensitive systems or cloud resources.
• Review password reuse exposure Identify where users are likely to reuse passwords across corporate, cloud and consumer accounts, then treat those accounts as linked compromise paths in your IAM risk model.
• Tighten authentication recovery flows Check whether password reset, SIM swap, help desk recovery and email-based sign-in steps undermine stronger authentication controls by creating easier takeover paths.
• Reduce standing password trust Move sensitive access toward passwordless or stronger MFA patterns so that access decisions depend less on a single secret that can be phished or stolen.

Key takeaways

• Password-only authentication remains fragile because a single secret can be stolen, reused or phished into broader account access.
• The article’s own usage data shows that password reuse is common, which increases the blast radius of one compromise.
• Stronger MFA and passwordless patterns matter because they reduce dependence on a reusable secret and raise the cost of takeover.

Key terms

• Password-Only Authentication: An authentication approach that relies on a password as the sole proof of identity. It is common in older corporate and legacy systems, but it creates predictable risk because stolen, guessed, or reused passwords can be used directly unless another control, such as MFA, is added.
• Multi-Factor Authentication: Multi-factor authentication requires two or more independent verification factors before access is granted. In practice, it reduces the chance that a stolen password alone will open a system, but it only works well when applied consistently across all high-risk access paths and identity types.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authentication recovery: Authentication recovery is the process used when a user cannot complete primary sign-in and needs access restored. It matters because recovery pathways can be weaker than the main authentication stack, especially for privileged accounts, and attackers often target those fallback controls when they are under-governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.