Topic starter
08/06/2026 4:35 pm
TL;DR: 93% of organisations still use passwords for business, even as 45% plan to adopt passwordless technology and 27% plan phishing-resistant MFA within the next year, signalling a slow shift away from credential-based risk, according to Axiad’s 2023 State of Authentication Survey. Passwords remain the weak link because AI-assisted phishing still outpaces governance and adoption friction, according to Axiad.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Path to Passwordless, Phishing-Resistant MFA: Emerging but Still a Long Road Ahead”.
By the numbers:
- 93% of respondents are still using passwords for business.
- 45% said they will use passwordless technology over the next year.
- 27% said they will use phishing-resistant multi-factor authentication over the next year.
Key questions
A: The first move is to identify the most sensitive applications and administrative accounts, then require MFA there before expanding broadly.
Q: Why do passwords remain such a common authentication weakness?
A: Passwords remain weak because they depend on human memory, user discipline, and secrecy under attack pressure.
Q: What are the signs that an authentication modernisation effort is stalling?
A: Common signs include high password exception rates, limited enrolment outside a pilot group, repeated help desk fallback to legacy sign-in, and delayed recovery design.
Practitioner guidance
- Prioritise passwordless migration for high-risk populations Start with privileged users, remote access, and systems that expose sensitive business workflows.
- Require phishing-resistant MFA for sensitive access paths Use phishing-resistant methods for administrators, finance, HR, and externally exposed applications where credential replay would have the highest impact.
- Inventory password recovery and exception paths Map every recovery route, bypass, and legacy exception that still depends on passwords, because those paths often preserve the old risk even after a modern login is added.
Bottom line: Passwords still dominate authentication even as organisations say they plan to move toward passwordless and phishing-resistant MFA.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 6:17 pm
Password dependence is now a governance failure, not a user convenience issue. The survey shows that most organisations still run authentication through reusable secrets even while they acknowledge the threat. That creates a control model built around compromise recovery instead of compromise resistance. The practitioner conclusion is simple: authentication strategy must be judged by attacker resilience, not by how familiar it feels to users.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should organisations implement phishing-resistant MFA for regulated access?
A: Start by mapping each protected system to the identity type that uses it, then choose a phishing-resistant method that fits that subject. Use passkeys for human login where appropriate, certificate-based authentication for machine or enterprise trust, and verify that enrollment, recovery, and revocation are part of the control, not afterthoughts.
👉 Read our full editorial: Phishing-resistant MFA is gaining ground, but passwords still dominate
This post was modified 4 days ago by NHI Mgmt Group