Topic starter
02/08/2026 12:24 pm
TL;DR: Phishing, weak defaults, stored credentials, and password reuse keep passwords as the main enterprise IAM attack surface, according to Unixi. Identity programs have to reduce password exposure first, or stolen credentials will keep enabling access.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “Passwords aren’t security, they’re bait”.
By the numbers:
- Weak or default passwords appear in 100% of the organisations Unixi assesses.
Key questions
Q: Why do passwords keep creating breach risk even when organisations enforce policy?
A: Because policy does not change human behaviour under pressure.
Q: What breaks when service account credentials are stored like ordinary user passwords?
A: Privilege concentration breaks down.
A: The first move is to identify the most sensitive applications and administrative accounts, then require MFA there before expanding broadly.
Practitioner guidance
- Eliminate password dependence for browser access Prioritise passwordless or secret-minimising access paths for browser-based applications that are reachable from outside the network.
- Reduce credential storage concentration Identify where service account passwords, recovery secrets, and browser-saved credentials are stored, then separate privileged material from everyday user access workflows.
- Harden recovery and fallback flows Review account recovery, reset, and help desk processes for places where password-based identity can be reintroduced after the main login path is improved.
Bottom line: Password dependence remains a structural IAM weakness because it turns human behaviour into a security control.
Glossary terms: Passwordless Authentication, Authentication Concentration Risk, Phishing-Resistant Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
02/08/2026 1:24 pm
Passwords are no longer an identity control, they are an abuse path. A secret that can be reused, phished, guessed, stored, and replayed is not a stable assurance mechanism. The enterprise keeps treating password policy as a behaviour problem, but the real issue is that the control assumes humans will act like deterministic security systems. Practitioners should treat password dependence as residual risk that survives policy.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: How do teams decide whether passwordless is appropriate for a specific use case?
A: Judge it by the risk of the action, not by the convenience of the channel. Low-risk sign-ins may tolerate weaker factors, but payment changes, account recovery, and sensitive profile edits need stronger proof. The decision should follow the transaction and the fraud exposure, not the preference for fewer passwords.
👉 Read our full editorial: Passwords remain the dominant identity attack surface in enterprise IAM