Topic starter
07/03/2026 1:05 am
TL;DR: Passwords remain a dominant breach vector, with the 2021 Verizon Data Breach Investigation Report attributing 89% of web application breaches to stolen credentials or brute force attacks, while legacy MFA still suffers from low adoption and user friction, according to Beyond Identity and Verizon. The real shift is that identity and device posture now define the access perimeter, so authentication must become cryptographic, device-aware, and continuous rather than password-centric.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “The Future of Authentication Technologies”.
By the numbers:
- Passwords caused 89% of web application breaches, either through stolen credentials or brute force attacks, according to Beyond Identity.
- 61% of all breaches exploited credential data via brute force attacks, credential stuffing attacks, or credential data leaked and used later, according to Beyond Identity.
Key questions
Q: How should security teams govern privileged access in cloud and hybrid environments?
A: Teams should govern privileged access around runtime authorization, not just connectivity or login.
Q: Why do legacy authentication protocols create risk after MFA is enabled?
A: Legacy protocols such as IMAP and POP can bypass MFA because they use password-only authentication paths that sit outside modern sign-in enforcement.
Q: What breaks when device trust is not part of privileged access decisions?
A: Privilege becomes detached from real session risk.
Practitioner guidance
- Replace password-dependent authentication flows Prioritise applications and remote access paths that still depend on reusable passwords or SMS-based second factors, then phase in cryptographic authentication where the risk is highest.
- Bind access decisions to device posture Require approval state, security configuration and device health to be checked before access is granted to cloud resources or sensitive applications.
- Reduce reliance on legacy MFA Inventory which applications still accept weak second factors and identify where user friction is driving bypass, help desk workarounds or low enrolment.
Bottom line: Password reuse, credential stuffing and brute-force attacks remain central to web application compromise, which is why password-centric authentication is losing relevance as a boundary control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:03 pm
Passwordless is becoming a trust boundary issue, not just an authentication preference. Once cloud adoption and hybrid work remove the network perimeter, identity assurance and device assurance have to carry the access decision. That makes passwordless a governance topic, not an UX feature. The practitioner conclusion is that authentication design now defines the boundary of the programme.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: When should organisations prioritise persistent authentication over a one-time login check?
A: Organisations should prioritise persistent authentication when users return repeatedly, transactions have financial impact, or account takeover would be costly. A one-time login check is weak in these environments because trust has to continue after entry. Persistent identity signals help teams reassess risk across the customer lifecycle and reduce reliance on static credentials alone.
👉 Read our full editorial: Why passwordless authentication is becoming the new trust boundary