Notifications
Clear all
Topic starter
06/06/2026 11:33 am
TL;DR: Generative AI (53%) and agentic AI (45%) have overtaken stolen credentials as the top identity security concern, according to HYPR’s 2026 State of Passwordless Identity Assurance report, while passwordless adoption remains stalled at 43% and 87% of organisations have faced audio or video deepfake attacks. The security problem has shifted from login friction to industrialised impersonation, and identity assurance now has to cover the full lifecycle, not just the sign-in moment.
NHIMG editorial — based on content published by HYPR: 2026 State of Passwordless Identity Assurance Report
By the numbers:
- The majority of organizations 87% have encountered audio or video deepfakes in identity-based attacks.
- Despite passkey literacy surging to 64%, enterprise-wide adoption remains stalled at 43%.
- Identity impersonation incidents surged by 35%, with candidate fraud emerging as the second most prevalent threat after credential misuse.
Questions worth separating out
Q: How should security teams implement identity verification alongside passwordless authentication?
A: Use passwordless to remove reusable secrets, then add identity verification at the points where impersonation risk is highest, such as onboarding, recovery, and privileged approvals.
Q: Why do deepfakes create a new identity security problem even when passwordless is deployed?
A: Deepfakes attack the trust layer around the workflow, not just the login screen.
Q: What do organisations get wrong when they treat identity verification as a pilot project?
A: They usually limit it to a small set of users or high-visibility use cases and leave the rest of the enterprise on older, weaker processes.
Practitioner guidance
- Expand identity verification beyond executive-only workflows Apply stronger identity proofing to onboarding, account recovery, help desk resets, vendor changes, and other high-risk flows where impersonation produces outsized impact.
- Measure identity coverage across the full workforce Track whether passwordless and identity verification are deployed across all users, not just a pilot group or a few high-value personas, and close the remaining exception paths.
- Harden recovery and exception handling paths Add independent verification steps for high-risk requests so a synthetic voice, video, or social-engineering pretext cannot satisfy the workflow on its own.
What's in the full report
HYPR's full press release covers the survey framing and the market context this post intentionally leaves for the source:
- Survey methodology and respondent mix from more than 950 security and IT leaders.
- The full breakdown of how deepfake, phishing, and impersonation risks are changing identity priorities.
- Adoption detail on passwordless, passkeys, and identity verification by enterprise segment.
- The vendor's own explanation of how identity assurance is positioned across the employee lifecycle.
👉 Read HYPR's report on identity verification, passwordless adoption, and AI risk →
Identity verification and passwordless adoption: what teams need now?
Explore further
06/06/2026 12:26 pm
Identity assurance is becoming the common control plane for human, NHI, and agentic identity. HYPR’s findings are not just about sign-in friction. They show that the trust problem now spans onboarding, recovery, verification, and lifecycle governance, which is exactly where human IAM and NHI governance start to converge. When synthetic media can impersonate a person and AI can accelerate fraud workflows, identity assurance becomes a cross-domain control issue, not a single authentication project. Practitioners should therefore stop treating passwordless, IDV, and lifecycle controls as separate programmes.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How should IAM teams respond when AI makes identity impersonation easier to scale?
A: They should reassess every process that relies on human judgement alone and add independent checks where a false identity can trigger access or payment changes. The right response is not only more authentication friction, but better assurance at the workflow level and consistent lifecycle coverage across people and systems.
👉 Read our full editorial: Identity verification is overtaking passwordless as AI risk grows
