Topic starter
12/06/2026 10:22 pm
TL;DR: 93% of respondents still use passwords for business, while 52% have already fallen victim to a password-based cyberattack and 45% plan to use passwordless technology next year, according to Axiad’s 2023 State of Authentication Survey. Passwordless and phishing-resistant MFA are advancing, but legacy friction and change resistance keep them from becoming the default.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Path to Passwordless, Phishing-Resistant MFA: Emerging but Still a Long Road Ahead”.
By the numbers:
- 45% said they will use passwordless technology over the next year.
- 27% said they will use phishing-resistant multi-factor authentication (MFA) over the next year.
- 93% of respondents are still using passwords for business.
Key questions
Q: How should organisations phase in passwordless authentication without disrupting access?
A: Start by inventorying every place a password is still used, including recovery and support paths.
Q: Why do phishing-resistant MFA methods matter if attackers can still get in?
A: They materially reduce real-time credential harvesting and replay attacks, which removes one of the easiest entry paths.
Q: What are the biggest barriers to moving away from passwords?
A: The most common blockers are operational, not theoretical: fear of change, perceived rip-and-replace work, time pressure, and limited staff.
Practitioner guidance
- Map password dependency by application and access path Identify where passwords remain the primary factor across workforce apps, admin access, recovery flows, and exception paths.
- Enforce phishing-resistant MFA for high-risk access Require phishing-resistant authentication on privileged, remote, and externally exposed access paths before extending it to lower-risk use cases.
- Sequence passwordless rollout by dependency, not enthusiasm Classify applications by authentication compatibility, recovery complexity, and support burden before setting migration dates.
Bottom line: Passwords remain entrenched even where organisations accept the risk, which makes authentication modernisation a governance problem as much as a technical one.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 1:05 am
Password dependence is now a control debt, not a convenience choice. The longer passwords remain the primary authentication method, the more organisations carry a control gap that attackers can repeatedly exploit through phishing and credential replay. This is not a temporary adoption lag. It is a structural exposure that persists until authentication assurance is raised across the estate. Practitioners should treat password dependency as an active governance debt, not a future improvement.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
A: Measure more than message volume. Track authentication success, abandonment, support contacts, recovery effort, step-up frequency, fraud losses, and customer effort across key journeys. If persistent authentication is working, trusted users should face fewer repeated challenges, high-risk events should still trigger stronger checks, and legitimate completion rates should improve without weakening assurance.
👉 Read our full editorial: Passwordless phishing-resistant MFA is still a long way off