Passwords remain the dominant identity attack surface in enterprise IAM

At a glance

What this is: This article argues that passwords remain the main enterprise IAM attack surface because human behaviour, phishing, weak defaults, and stored credentials keep them exploitable.

Why it matters: IAM teams should treat password dependence as a structural control problem, not a user-training problem, because it keeps identity abuse paths open across human and machine-adjacent access patterns.

By the numbers:

• Weak or default passwords appear in 100% of the organisations Unixi assesses.

Context

Passwords are a human-authenticated control that still sits at the centre of enterprise access, even though it is easier to steal, reuse, phish, and store unsafely than to govern reliably. In IAM terms, the problem is not only weak password choice, but the fact that user-managed secrets create an identity assurance model that depends on behaviour under pressure.

The article’s core claim is that this creates a persistent attack surface across browser-based applications, service account handling, and account recovery paths. That makes the issue relevant to human IAM first, but also to adjacent lifecycle and privileged access decisions where credentials outlive the people who created them.

Key questions

Q: What should security teams do first when they still rely on password-only authentication for some resources?

A: The first move is to identify the most sensitive applications and administrative accounts, then require MFA there before expanding broadly. Password-only access leaves organisations exposed because stolen credentials remain enough for entry. Teams should pair rollout with user-friendly enrollment, clear policy enforcement, and a plan to replace telephony-based methods with stronger options.

Q: Why do passwords keep creating breach risk even when organisations enforce policy?

A: Because policy does not change human behaviour under pressure. Users still reuse secrets, choose weak variations, store them in tools, or hand them to phishing kits, which means the same credential can be captured and replayed. The risk persists until the access model stops depending on user-managed knowledge secrets.

Q: What breaks when service account credentials are stored like ordinary user passwords?

A: Privilege concentration breaks down. A stored service account secret turns a single vault, browser profile, or support workflow into a path to privileged access, especially if the credential is reused across systems. That is why machine and service credentials need stricter handling than ordinary user logins.

Q: How do teams decide whether passwordless is appropriate for a specific use case?

A: Judge it by the risk of the action, not by the convenience of the channel. Low-risk sign-ins may tolerate weaker factors, but payment changes, account recovery, and sensitive profile edits need stronger proof. The decision should follow the transaction and the fraud exposure, not the preference for fewer passwords.

Technical breakdown

Why password reuse and weak defaults keep identity risk alive

Passwords fail as a durable identity control because they are both knowledge-based and transferable. Once a password is reused, guessed, written down, or stored insecurely, the attacker does not need to break the account boundary again. This is why weak defaults remain so damaging: they collapse the work factor required for compromise to a level that modern cracking tools, infostealers, and commodity phishing kits can exploit quickly. In practice, the technical issue is not simply credential strength, but the fact that the credential itself becomes the single point of failure for identity proof and session initiation.

Practical implication: Treat password exposure as a control-design failure, not a user mistake.

Why stored credentials in password managers still create exposure

Storing credentials in browsers or password managers does not remove the attack surface if the vault or the host environment is already compromised. The article points to service account credentials being stored in a password manager, which turns a convenience feature into a concentration point for privileged access. At that point, the attacker is no longer trying to guess individual passwords one by one. They are targeting the place where many credentials, relationships, and recovery options are already aggregated. That changes the problem from authentication hygiene to credential estate protection.

Practical implication: Inventory where credentials are stored and treat those stores as high-value targets.

How phishing and infostealers exploit password-centric authentication

Password-centric authentication gives attackers a broad set of collection paths: fake login pages, adversary-in-the-middle kits, social engineering over the phone, and malware that extracts credentials from endpoints or browsers. These techniques work because the secret can be replayed elsewhere once captured. Even when an organisation layers MFA on top, stolen passwords still enable account takeover attempts, session interception, or fallback abuse if recovery flows are weak. The deeper architectural issue is that the secret is portable and reusable across too many applications and support processes.

Practical implication: Reduce replay value by removing or constraining password use where the platform allows it.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwords are no longer an identity control, they are an abuse path. A secret that can be reused, phished, guessed, stored, and replayed is not a stable assurance mechanism. The enterprise keeps treating password policy as a behaviour problem, but the real issue is that the control assumes humans will act like deterministic security systems. Practitioners should treat password dependence as residual risk that survives policy.

Credential concentration is the hidden risk behind password convenience. When passwords, service account secrets, and recovery paths accumulate in browser stores or password managers, the estate becomes easier to target than the applications it protects. That shifts the attacker’s objective from individual account takeover to bulk credential harvesting. The named concept here is credential concentration risk: a single store or workflow becomes the highest-value point of failure for many identities. Practitioners should map where that concentration exists.

Phishing succeeds because password-based identity is inherently replayable. Once a password is captured, the attacker can test it across services, use it in adversary-in-the-middle flows, or combine it with social engineering. That replayability is what makes password theft so resilient as a criminal tactic. The implication for IAM programmes is clear: reduce reliance on knowledge-based secrets where the identity model allows it, especially for externally reachable applications.

The long-term answer is not better user discipline, it is removing user control over the secret. The article is strongest when it argues that identity security cannot keep asking end users to compensate for a flawed model. That logic applies across human IAM and the adjacent management of service credentials. Practitioners should see this as an architectural decision about where trust lives, not a training problem.

Passwords expose a governance mismatch between access design and actual user behaviour. Policy assumes users will choose strong, unique secrets and manage them consistently, but enterprise reality repeatedly contradicts that assumption. The more applications, recovery paths, and support exceptions that depend on passwords, the more the governance model drifts away from how access is really used. Teams should re-evaluate whether their IAM programme is securing identity or merely documenting a weak dependency.

From our research library:

• The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.

What this signals

Credential concentration risk: The deeper problem is not that users forget passwords, but that organisations accumulate identity trust in places attackers already know how to target. Once browser stores, password managers, and recovery workflows hold the keys, the programme is managing a collection problem rather than an authentication problem.

Passwordless adoption changes the control objective from educating users to shrinking the number of replayable secrets in circulation. For identity teams, that is a governance shift: the question becomes which applications still require user-managed passwords, and whether those exceptions are justified.

For practitioners

• Eliminate password dependence for browser access Prioritise passwordless or secret-minimising access paths for browser-based applications that are reachable from outside the network. Focus first on systems where password reuse, phishing, or support-driven reset activity creates recurring risk.
• Reduce credential storage concentration Identify where service account passwords, recovery secrets, and browser-saved credentials are stored, then separate privileged material from everyday user access workflows. The goal is to stop one store from becoming the easiest way into many accounts.
• Harden recovery and fallback flows Review account recovery, reset, and help desk processes for places where password-based identity can be reintroduced after the main login path is improved. If recovery still depends on reusable secrets, the attack surface remains intact.
• Target the most exposed applications first Start with externally reachable applications that support only partial federation or inconsistent SSO coverage. These are the places where users are most likely to reuse secrets, and where attackers get the broadest payoff from a single compromise.

Key takeaways

• Password dependence remains a structural IAM weakness because it turns human behaviour into a security control.
• Stored credentials, weak defaults, and phishing all make passwords easy to reuse and hard to govern.
• The practical response is to reduce password exposure, starting with the most reachable applications and credential stores.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authentication Concentration Risk: The condition where a small number of credentials or identity controls govern access to many services, increasing the impact of compromise or misconfiguration. This is especially relevant in SSO deployments, where convenience improves only if the central trust path is engineered with strong assurance and recovery controls.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.