Topic starter
10/07/2026 9:25 pm
TL;DR: Passwords still reached 93% of workforce users and 56% of organisations kept them after passkey deployment, according to Enzoic’s analysis of Okta’s 2025 Secure Sign-in Trends Report, showing that hybrid authentication leaves a large residual risk layer. The practical answer is continuous credential screening, not a false choice between passwords and passkeys.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Hybrid Authentication Environments”.
By the numbers:
- 93% of users in workforce environments still used passwords as of January 2025, according to Okta research cited by Enzoic.
- 56% of organizations still kept passwords as an authentication method even after deploying passkeys, according to Enzoic’s analysis of Okta research.
Key questions
Q: What should identity teams do when passkeys coexist with password-era workflows?
A: Decide which legacy flows will be retired, which will be time-limited, and which will be prohibited entirely.
Q: Why do exposed passwords remain dangerous even after modern authentication is deployed?
A: Because exposure often happens upstream of the login event.
Q: Why do password controls fail in hybrid environments?
A: They fail when coverage stops at the directory or the newest identity platform.
Practitioner guidance
- Inventory every password-dependent access path Map legacy applications, Active Directory, VPN, customer portals, administrative workflows, and recovery flows that still trust passwords.
- Screen credentials at issuance and reset Block known-bad passwords when users create or reset them, and extend the same screening logic to privileged and recovery workflows where password trust remains.
- Monitor for exposed credentials continuously Use ongoing checks for breach exposure, reuse, and infostealer-derived credential risk so a password is not treated as safe simply because it passed a one-time policy check.
Bottom line: Hybrid authentication leaves a large residual attack surface because many enterprise systems still rely on passwords even after passkeys are introduced.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:47 pm
Hybrid authentication is now a permanent governance state, not a transition phase. Most enterprises will keep passwords alive across legacy, vendor, and recovery paths even after passkeys are deployed elsewhere. That means identity programmes must govern coexistence, not chase an imagined cutover date. The practitioner conclusion is simple: manage the residual password estate as a first-class risk domain.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations reduce the blast radius of remaining password access?
A: By limiting password-based access to the smallest possible set of systems and removing it from high-risk paths such as administrative workflows, remote access, and recovery processes where stronger methods are available. The goal is not perfection, but shrinking the number of trusted password-bearing routes attackers can exploit.
👉 Read our full editorial: Hybrid authentication environments still need password risk reduction