Notifications
Clear all
Topic starter
12/06/2026 10:07 pm
TL;DR: A 2022 Authentication Survey of 252 U.S. security and IT executives found 86% plan to implement passwordless or already have, while 70% say authentication complexity overwhelms them, according to Axiad. That gap shows authentication programmes still fail when architecture, visibility, and user experience are treated separately.
NHIMG editorial — based on content published by Axiad: Don’t Let Underlying IT Complexity Block Your Road to Successful Authentication
By the numbers:
- An overwhelming 86% told us they plan to implement a passwordless strategy in the next 12 months, or already have done so.
- 70% of survey respondents said they are overwhelmed by the complexity of their authentication systems.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should teams roll out passwordless authentication without creating new bypass risks?
A: Start with the authentication paths that create the most friction and operational inconsistency, then simplify the control model before broad rollout.
Q: Why does authentication complexity increase security risk even when controls are stronger?
A: Complexity increases risk because strong controls do not help if they are applied inconsistently across silos, legacy systems, and recovery paths.
Q: What signals show that a passwordless programme is not working in practice?
A: Rising helpdesk volume, repeated fallback use, excess admin effort, and growing exception requests are all signs that the programme is fragile.
Practitioner guidance
- Inventory every authentication path Document primary login flows, step-up paths, recovery processes, and application-specific exceptions so you can see where the same user is being authenticated in different ways.
- Reduce authentication silos before expanding passwordless Consolidate duplicated directories, authentication policies, and admin workflows where possible.
- Measure friction as a security metric Track helpdesk calls, reset volume, fallback usage, and bypass requests alongside authentication success rates.
What's in the full article
Axiad's full research covers the survey detail this post intentionally leaves at the strategy level:
- The full breakdown of survey responses by challenge area, including complexity, visibility, phishing, and ransomware.
- Practical guidance on integrating existing authentication tools instead of replacing them wholesale.
- The detailed friction and administration findings that support rollout planning and internal business cases.
- Survey context on how executives view authentication as part of risk management rather than a standalone IT issue.
👉 Read Axiad's survey analysis on authentication complexity and passwordless adoption →
Authentication complexity and passwordless adoption: where teams get stuck?
Explore further
13/06/2026 12:40 am
Authentication complexity is a governance failure, not just an implementation nuisance. The article shows that 70% of respondents are overwhelmed by authentication complexity while 42% cite a lack of visibility across practices. That combination means the control plane is already fragmented before any passwordless migration begins. The practitioner conclusion is that authentication governance has to be redesigned as a system, not patched product by product.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
A: If authentication paths are fragmented, visibility is poor, and support effort is already high, stabilising the current environment comes first. Modernisation without simplification usually adds another layer of inconsistency. Teams should fix the control plane, then scale passwordless where the operating model can support it.
👉 Read our full editorial: Authentication complexity is still blocking passwordless adoption
