Passwordless phishing-resistant MFA is still a long way off

At a glance

What this is: This is Axiad’s analysis of its 2023 State of Authentication Survey, showing that passwordless and phishing-resistant MFA are gaining momentum but passwords still dominate business authentication.

Why it matters: IAM teams need to understand why adoption is still stuck, because authentication change is now being driven by phishing risk, AI-enabled credential attacks, and Zero Trust expectations across human and non-human access.

By the numbers:

• 45% said they will use passwordless technology over the next year.
• 27% said they will use phishing-resistant multi-factor authentication (MFA) over the next year.
• 93% of respondents are still using passwords for business.
• 52% have fallen victim to a password-based cyberattack.

Context

Password-based authentication remains the default for most organisations even as phishing gets more convincing and credential theft becomes easier to scale. In identity security terms, this is not just a user-experience problem. It is a governance problem because the organisation is still relying on a factor that attackers can repeatedly target, replay, and automate.

Axiad’s survey points to a transition that is underway but incomplete. Passwordless authentication and phishing-resistant MFA are advancing, yet the operational friction of change, the perceived need to replace existing technology, and staffing constraints continue to delay adoption across IAM programmes.

Key questions

Q: How should organisations phase in passwordless authentication without disrupting access?

A: Start by inventorying every place a password is still used, including recovery and support paths. Then target the highest-risk or highest-friction journeys first, measure user impact, and expand only after assurance and usability remain stable. The goal is a controlled transition, not an overnight replacement of every login method.

Q: Why do phishing-resistant MFA methods matter if attackers can still get in?

A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths. But they do not stop an attacker who already controls a valid session through social engineering, stolen tokens, or compromised administrators. The practical goal is to reduce entry opportunities and then limit post-login blast radius.

Q: What are the biggest barriers to moving away from passwords?

A: The most common blockers are operational, not theoretical: fear of change, perceived rip-and-replace work, time pressure, and limited staff. Those constraints slow migration because identity teams must coordinate applications, recovery flows, and user support at the same time. Planning for those dependencies is what makes adoption feasible.

Q: How do organisations know whether persistent authentication is actually improving security and experience?

A: Measure more than message volume. Track authentication success, abandonment, support contacts, recovery effort, step-up frequency, fraud losses, and customer effort across key journeys. If persistent authentication is working, trusted users should face fewer repeated challenges, high-risk events should still trigger stronger checks, and legitimate completion rates should improve without weakening assurance.

Technical breakdown

Why passwords still persist in authentication programmes

Passwords persist because they are embedded across legacy identity providers, application estates, help desk workflows, and user habits. Even when organisations understand the risk, authentication change is rarely a single control swap. It is a migration across provisioning, recovery, device trust, policy, and support processes. That makes the problem less about technology availability and more about whether the identity programme can absorb operational change without disrupting access. For IAM teams, the real issue is not whether stronger methods exist. It is whether the organisation can replace password dependence without creating unacceptable business friction.

Practical implication: treat password removal as a programme change, not a point product rollout.

How phishing-resistant MFA changes the authentication trust model

Phishing-resistant MFA narrows the attack path because it reduces the value of captured credentials and the likelihood that an attacker can reuse them in a separate context. The security shift is important: authentication becomes more bound to the genuine user, device, or cryptographic proof instead of a shared secret that can be phished or replayed. That matters for human IAM first, but it also influences service access patterns where token theft and delegated trust are the real problem. In practice, phishing-resistant controls are strongest when they are enforced as a default, not offered as an optional second factor.

Practical implication: prioritise phishing-resistant authentication for users and access paths with the highest credential theft exposure.

Why operational friction slows passwordless adoption

The survey’s barriers tell a familiar IAM story. Fear of change, rip-and-replace concern, limited time, and limited staff all reflect the same reality: identity teams are being asked to improve assurance while preserving business continuity. Passwordless programmes often fail when they are framed as a wholesale replacement rather than a controlled transition that respects existing identity infrastructure. The practical challenge is governance, sequencing, and integration, not just the authentication method itself. Organisations that cannot map dependencies across applications, recovery processes, and exception handling will continue to stall even when they agree with the target state.

Practical implication: inventory dependencies and migration constraints before setting passwordless adoption targets.

Threat narrative

Attacker objective: The attacker’s objective is to obtain authenticated access that bypasses user intent and enables account compromise at scale.

1. Entry begins with credential theft or phishing against a user who still relies on passwords and reusable factors.
2. Escalation follows when the captured credential is replayed into business systems that accept password-based authentication.
3. Impact occurs when the attacker uses that authenticated access to compromise accounts, data, or downstream workflows before the intrusion is detected.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password dependence is now a control debt, not a convenience choice. The longer passwords remain the primary authentication method, the more organisations carry a control gap that attackers can repeatedly exploit through phishing and credential replay. This is not a temporary adoption lag. It is a structural exposure that persists until authentication assurance is raised across the estate. Practitioners should treat password dependency as an active governance debt, not a future improvement.

Phishing-resistant MFA changes the attack economics, but only when it becomes the default path. Optional deployment leaves too much of the attack surface intact because adversaries will continue to target the weakest accepted factor. The lesson for identity programmes is that assurance has to be enforced at policy level, not left to individual user choice. That is the point at which phishing resistance starts to matter operationally.

Identity migration friction is the named barrier that explains most stalled programmes. Fear of change, rip-and-replace anxiety, time pressure, and staff shortages all point to the same governance issue: identity teams are being asked to alter authentication without a clean transition model. The field should read this as a programme design problem, not an authentication technology problem. The implication is that adoption fails when migration sequencing is left undefined.

Authentication modernisation is becoming a Zero Trust prerequisite rather than a standalone initiative. The more organisations move toward continuous verification, the less defensible password-centric access becomes. That matters for human IAM today and for broader identity governance later, because the same assurance expectations increasingly shape workload, service, and delegated access patterns. Practitioners should align authentication roadmaps with Zero Trust, not run them as disconnected projects.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Identity migration friction is becoming the main reason authentication modernisation stalls. Passwordless adoption does not fail because the technology is unavailable. It fails when identity teams cannot sequence application changes, recovery changes, and user support at the same time.

Phishing-resistant MFA should be treated as an assurance baseline for high-risk access, not an optional enhancement. Once attackers can automate credential harvesting, the remaining question is which access paths still tolerate replayable secrets and which ones no longer should.

For practitioners

• Map password dependency by application and access path Identify where passwords remain the primary factor across workforce apps, admin access, recovery flows, and exception paths. Use the map to prioritise the accounts and systems that face the highest phishing exposure.
• Enforce phishing-resistant MFA for high-risk access Require phishing-resistant authentication on privileged, remote, and externally exposed access paths before extending it to lower-risk use cases. The goal is to remove replayable secrets from the most targeted entry points.
• Sequence passwordless rollout by dependency, not enthusiasm Classify applications by authentication compatibility, recovery complexity, and support burden before setting migration dates. A staged cutover reduces the risk that passwordless becomes an aspirational policy with no operational path.
• Update recovery and exception handling first Review fallback authentication, help desk reset flows, and break-glass procedures before moving users to passwordless or phishing-resistant MFA. Weak recovery paths often become the easiest way back into a stronger authentication programme.

Key takeaways

• Passwords remain entrenched even where organisations accept the risk, which makes authentication modernisation a governance problem as much as a technical one.
• Survey responses show strong intent to move toward passwordless and phishing-resistant MFA, but the transition is slowed by operational friction and resource constraints.
• The practical break point is policy enforcement and migration sequencing, not awareness alone, because attackers still benefit whenever passwords remain the fallback.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Authentication Fallback Path: A backup route used when the primary authentication method fails or is unavailable. It matters because attackers often target the weakest supported path, and many passwordless programmes inherit password or weak proofing in recovery, support, or re-enrolment workflows.
• Identity Migration: The planned movement of identity data, configuration, and control logic from one operating model to another. For cloud identity security, the hard part is usually preserving governance outcomes after the platform, release cadence, and support model change.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.