Passwords are still slowing work and exposing authentication gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Axiad's blog post: Password-based authentication is creating measurable work disruption, with lockouts, forgotten credentials, and long recovery times affecting a large share of office workers.

Why it matters: IAM teams need to treat password friction as an access-governance issue because repeated authentication failures slow productivity, increase help desk load, and weaken the case for legacy login patterns.

By the numbers:

• 60% of US workers surveyed said authentication processes have stopped them from doing their jobs.
• 59% had to contact the IT department because they were locked out of their computer.
• 4 hours 43 minutes were needed, on average, to fix authentication issues at work.

Context

Passwords are a human authentication control, but in practice they often behave like a recurring operational fault line. When employees cannot log in, the problem quickly becomes an IAM, help desk, and productivity issue at the same time.

Axiad’s survey frames the issue as more than inconvenience: authentication friction interrupts work, drives support calls, and exposes the gap between what organisations think their login controls achieve and what employees actually experience.

For IAM programmes, that means password policy alone is not a sufficient measure of control health. The relevant question is whether the authentication stack reduces disruption while still preserving security assurance.

Key questions

Q: How should organisations reduce password-related lockouts without weakening security?

A: They should move the highest-friction user groups to stronger authentication methods, then track whether lockouts, reset calls, and recovery time fall. The goal is not to remove assurance, but to remove dependency on memorised secrets as the default access method. If the same users keep failing login, the authentication design is not aligned with how they work.

Q: Why do passwords create so much help desk demand?

A: Because they fail in predictable ways: people forget them, reuse them, lock themselves out, or need resets after expiry. Each failure creates a service event and often a recovery step that is slower than authentication itself. When those events become frequent, authentication design is driving operational friction instead of reducing it.

Q: What are the signs that authentication is hurting productivity?

A: Common signs include frequent lockouts, repeated reset requests, long restore times, and employees reporting that they cannot access work tools when needed. When those signals rise together, the authentication layer is no longer just protecting access. It is delaying it.

Q: Should organisations replace MFA with passwordless authentication?

A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.

Technical breakdown

Why password-based authentication creates recurring access friction

Passwords fail as a stable access mechanism because they depend on human memory, frequent reuse, and user-managed recovery paths. In enterprise settings, each failed login can trigger a cascade of resets, help desk tickets, and application lockouts. That is not simply a usability issue. It reflects a weak fit between static credentials and the pace of modern work, where users need reliable access across multiple systems and sessions. When a large share of users still relies on passwords alone, authentication becomes a bottleneck rather than a control layer.

Practical implication: measure authentication friction as an operational control metric, not just a user complaint.

Why lockouts turn identity issues into productivity loss

A lockout is rarely isolated to one application. Users often lose access to communication tools, productivity apps, and internal systems at the same time, which multiplies the business effect of a single failed login. The survey data shows that support dependency grows when users have no alternative authentication path and must involve IT to recover access. That makes credential recovery part of the access lifecycle, not a separate service desk problem. The operational failure is the delay between identity verification, recovery, and restored work access.

Practical implication: design recovery paths that restore access without turning every outage into a manual IT case.

Where password-only environments fall short of modern authentication

Password-only environments assume that a secret can serve as both proof of identity and a durable access method. In practice, that model produces weak assurance, predictable user workarounds, and repeated resets. Multi-factor authentication and passwordless methods change the equation by reducing reliance on memory-based secrets and lowering the number of times a user must prove identity through a brittle fallback. The article’s findings do not prove one specific replacement is always right, but they do show that password-only models are structurally expensive in time and support effort.

Practical implication: prioritise authentication methods that reduce dependence on shared human memory and reset cycles.

NHI Mgmt Group analysis

Password friction is an identity governance failure, not a convenience problem. When authentication repeatedly blocks work, the access model has failed the organisation's operational requirements. The issue is not that users dislike passwords, but that the control produces avoidable recovery events and predictable support overhead. IAM teams should treat this as a governance signal that authentication design is misaligned with business use.

Passwords create hidden productivity debt across the access lifecycle. Every forgotten credential, reset, and lockout consumes time that never appears in a security dashboard but is very real in operational cost. The survey’s pattern shows that identity controls can degrade work even when they technically function as designed. The broader lesson is that authentication quality must be measured by interruption rate, not by policy existence alone.

Passwordless adoption is being driven as much by operational necessity as by security posture. The case for modern authentication strengthens when users, help desks, and business teams all absorb the cost of repeated password recovery. That shifts the programme conversation from optional UX improvement to access resilience. Identity leaders should reframe passwordless not as a feature preference, but as a control evolution.

Authentication design should be evaluated as part of workforce continuity. If employees cannot reliably reach the tools they need, the identity programme is affecting business performance directly. That makes access reliability a management concern for IAM, IGA, and service desk leadership alike. Organisations should align authentication decisions with the time lost to lockouts, resets, and manual recovery.

Credential memory is a weak foundation for enterprise access. Password systems depend on users retaining and reproducing secrets under pressure, which is exactly where human error becomes operational drag. The article reinforces a long-standing identity principle: controls that rely on perfect recall generate recurring exceptions. Practitioners should view the persistence of password friction as evidence that the control model itself needs replacement.

From our research library:

• According to Forrester Research, a single password reset can cost around $70.

What this signals

Password friction is a continuity issue: when users cannot authenticate quickly, the identity programme directly affects productivity, support load, and business resilience. Teams should track the operational cost of lockouts and resets as closely as they track availability.

Modern authentication strategy should be judged by how often it removes work interruption, not by how well it preserves a password-first status quo. If authentication still depends on repeated memory tests and manual recovery, the programme is absorbing avoidable friction rather than controlling it.

For practitioners

• Measure authentication friction as a control metric Track lockouts, reset frequency, and time-to-restore access alongside uptime and login success rates. Use those measures to identify where password flows are creating unnecessary work interruption.
• Reduce dependence on password recovery Map the steps users follow when they forget credentials and remove manual handoffs where possible. The goal is to shrink the number of cases that require IT intervention before work can resume.
• Expand authentication options beyond passwords Prioritise passwordless or stronger multi-factor methods for the systems that generate the most lockouts and help desk traffic. Focus on the user journeys where login failure has the biggest business impact.
• Review access recovery as part of IAM governance Treat account recovery, device access, and identity proofing as part of the same governance flow, not separate support tasks. This helps prevent repeated lockouts from becoming an accepted operating norm.

Key takeaways

• Password-based authentication can become an operational bottleneck when it repeatedly stops employees from reaching the systems they need.
• The survey shows that lockouts and recovery consume meaningful time, which turns identity issues into productivity loss and help desk demand.
• IAM teams should treat authentication modernisation as a continuity and governance decision, not only a security upgrade.

Key terms

• Authentication Friction: The delay, confusion, and support burden created when users cannot complete sign-in cleanly. In IAM programmes, friction is a governance signal because it drives resets, exceptions, and workarounds. If users routinely hit the recovery path, the authentication design is not yet operationally stable.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Account Recovery: Account recovery is the process used to restore access when a user cannot authenticate normally. In mature IAM programmes, recovery is treated as part of the trust chain because a weak reset path can bypass stronger login controls and become the easiest route to account takeover.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.