Notifications
Clear all
Topic starter
02/08/2026 12:24 pm
TL;DR: Passwords remain the #1 attack vector for breaches, and the article argues that weak reuse, phishing, and stored credentials make user-managed authentication structurally unreliable, according to Unixi. The case for eliminating password dependence is less about convenience than removing a persistent identity abuse path.
NHIMG editorial — based on content published by Unixi: passwords and identity security in browser-based access
By the numbers:
- At Unixi, our weekly enterprise discoveries reveal weak or default passwords in 100% of organizations we assess.
- Traditional SSO helps, but as many as 50% of enterprise apps still don’t support SAML integration.
- Passkeys are supported by only 100–200 apps, while FIDO keys work with about 800.
Questions worth separating out
Q: How should IAM teams reduce password-related productivity loss?
A: They should start by measuring where password failures interrupt work most often, then redesign the highest-friction journeys first.
Q: Why do weak passwords keep causing breaches even when users are trained?
A: Training does not change the underlying constraint that people are asked to invent and remember complex secrets under cognitive load.
Q: What breaks when password policies are not enforced across legacy systems?
A: The control breaks where the organisation cannot apply rotation, logging, or recovery consistently.
Practitioner guidance
- Map password exception debt across the application estate Inventory every browser-based application that still relies on passwords, including legacy apps, external SaaS, and admin portals.
- Prioritise secret removal over password complexity rules Shift from forcing longer passwords to eliminating user-held credentials where practical.
- Review recovery and fallback paths as part of authentication design Test what happens when users lose devices, miss enrollment, or need break-glass access.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- A vendor-specific breakdown of how Universal SSO and KDA handle browser-based authentication across legacy and SaaS applications.
- Implementation claims around password disappearance, phishing resistance, and application coverage gaps that are not unpacked here.
- The article’s comparison of passwordless approaches with traditional SSO, passkeys, and FIDO from the vendor’s perspective.
- Commercial and rollout context that practitioners would need before deciding whether the approach fits their environment.
👉 Read Unixi’s article on eliminating password risk in browser-based IAM →
Enterprise passwords and identity risk: are your controls keeping up?
Explore further
02/08/2026 1:24 pm
Password reliance is a human governance failure, not a user-training problem. The article’s strongest point is that organisations keep outsourcing identity discipline to end users who are under time pressure and rewarded for speed. That model predictably produces reuse, note-taking, browser storage, and phishing success. The implication is that IAM programmes should stop treating password hygiene as a behaviour issue and treat it as an architecture issue.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how weak identity inventory still is in practice.
A question worth separating out:
Q: Who is accountable for the exceptions in a passwordless rollout?
A: IAM, endpoint, and platform teams share accountability because the exceptions usually arise at the boundary between device support, application integration, and remote access design. Governance should require explicit ownership for every unsupported use case, so fallback methods do not become unmanaged permanent controls.
👉 Read our full editorial: Passwords remain the dominant identity attack surface in enterprise IAM
