Topic starter
26/08/2026 11:51 am
TL;DR: Passwords and SMS-based authentication still dominate, while passkey awareness remains uneven and AI-driven phishing concerns are rising, according to Yubico’s 2025 Global State of Authentication survey of 18,000 employed adults across nine countries. The gap is not technical novelty but user education, inconsistent policy, and weak phishing-resistant coverage across work and personal accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “2025 Global State of Authentication survey: A world of difference in cybersecurity habits”.
By the numbers:
- Yubico’s 2025 Global State of Authentication survey polled 18,000 employed adults across nine countries.
- 26% of respondents still believe a simple username and password is the most secure way to protect an account.
- 41% of respondents place their trust in vulnerable SMS-based authentication.
Key questions
Q: How should security teams roll out passkeys without creating support problems?
A: Start with recovery design, user communication, and help desk readiness.
Q: Why do password and SMS based authentication still create so much risk for businesses and consumers?
A: Password and SMS based authentication remain risky because they are easy to phish, reuse, intercept, or social engineer.
Q: What signs show that authentication policy is too inconsistent?
A: Look for different rules by role, app, or device, plus exceptions that have become permanent.
Practitioner guidance
- Enforce phishing-resistant MFA for high-value access Require passkeys or hardware security keys for administrators, remote access, and any workflow that can reach sensitive systems or data.
- Remove password-only fallback paths Audit applications, VPNs, and legacy SSO routes to find where passwords or SMS remain accepted as a primary or recovery path.
- Standardise authentication policy across roles Apply one minimum authentication standard across user groups, then treat exceptions as temporary risk decisions with explicit ownership.
Bottom line: Passwords and SMS still dominate too many authentication journeys, which keeps phishing and credential theft effective against both work and personal accounts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Passwords are no longer a defensible default for high-value access: They persist because they are easy to deploy, not because they align with current attack methods. When phishing, credential stuffing, and AI-assisted social engineering dominate the threat environment, password dependence becomes a governance failure, not a user preference. Organisations that still treat password usage as acceptable baseline security are managing yesterday’s compromise model.
A question worth separating out:
A: Use hardware security keys for high risk roles, regulated environments, and shared or unmanaged devices where physical possession matters. Use passkeys for everyday workforce and consumer logins where convenience, cross device access, and lower user friction are priorities. Many organisations deploy both, reserving hardware keys for administrators and passkeys for broader passwordless adoption.
👉 Read our full editorial: Global authentication habits still favor passwords over passkeys