Topic starter
12/06/2026 10:16 pm
TL;DR: 2020 accelerated remote work, exposed persistent password and MFA weaknesses, and highlighted how phishing, credential theft, ransomware, and SolarWinds-style supply chain compromise can overwhelm identity controls, according to Axiad. The lesson is that identity security must assume bypass, not just authentication success.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Major Cybersecurity Themes of 2020”.
By the numbers:
- At the beginning of 2020, more than half of CIOs expected an increase in remote workers.
- Only 57% of businesses were utilizing MFA by last fall.
- Ninety-one percent of people understand that repurposing passwords is a security risk, but 66% still do so.
Key questions
Q: Why does remote work increase identity risk even when MFA is in place?
A: Remote work increases identity risk because MFA does not remove the pressure created by more devices, more apps, and more credentials.
Q: What breaks when MFA is not native to the identity platform?
A: When MFA is not native to the identity platform, enforcement often becomes uneven across applications, user groups, and access paths.
Q: How do security teams know whether zero-trust remote access is actually working in practice?
A: Security teams should look for evidence that users only reach approved resources, sessions are brokered through controlled gateways, and access decisions are enforced consistently across cloud and on-prem systems.
Practitioner guidance
- Tighten temporary credential handling Eliminate email-based temporary passwords where possible and require stronger recovery paths for remote users.
- Reassess MFA coverage across access paths Check not only whether MFA exists, but whether it is enforced for all remote access routes, privileged access, and account recovery flows.
- Verify device trust before access is granted Define which devices may connect to corporate systems and require verification for company-owned and personal devices alike.
Bottom line: Remote work in 2020 exposed how quickly identity assumptions break when users operate outside the office perimeter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
13/06/2026 12:55 am
Remote work turned identity assurance into a continuous control problem. The article shows that office-centric assumptions no longer held once work moved to home networks, personal devices, and emergency login paths. That changes the identity programme from proving who a user is once to proving that access remains trustworthy across changing conditions. For practitioners, the lesson is to treat remote access as a governed journey, not a single authentication event.
A question worth separating out:
Q: Why do phishing and credential theft still matter in zero trust programmes?
A: Because zero trust is about continuous verification, not a one-time sign-in. Phishing and credential theft remain effective when teams assume authentication success equals safety. The programme has to limit what an authenticated identity can do next, especially in remote environments.
👉 Read our full editorial: 2020 showed identity security gaps widening under remote work
This post was modified 3 days ago by NHI Mgmt Group