Why do password-based logins remain a weak point even when organisations add extra authentication steps?

Why This Matters for Security Teams

Adding a second step to password login often improves resilience, but it does not remove the core weakness of a shared secret at the front door. Passwords are still phishable, replayable, and frequently reused across services, which means the first factor remains the easiest path for attackers. NIST guidance on authentication controls in NIST SP 800-53 Rev 5 Security and Privacy Controls treats authentication as a layered control, not proof that one factor can absorb all risk. That distinction matters because many organisations overestimate what MFA can do once the password has already been compromised.

The practical issue is that password-based access creates a broad attack surface before any stronger factor is even evaluated. Phishing kits, credential stuffing, help-desk social engineering, and session theft all target the same weak point. Even when the second factor is strong, recovery flows, legacy exceptions, and push prompts can become the real path of entry. In practice, many security teams encounter account takeover only after suspicious logins, token abuse, or vendor compromise has already occurred, rather than through intentional testing of the login flow.

How It Works in Practice

Security teams reduce risk most effectively when they stop treating passwords as the primary trust anchor. The stronger pattern is to move toward phishing-resistant authenticators, device-bound credentials, and tightly governed recovery paths. If passwords must remain in place for compatibility, they should be paired with controls that limit blast radius: conditional access, session binding, step-up verification for sensitive actions, and aggressive detection for reuse and impossible travel.

The problem is not only authentication strength, but where the identity proof breaks down. A password plus one-time code still depends on a shared secret being presented first, which means the attacker can often get a valid session by stealing the password and then coercing, intercepting, or racing the second factor. This is why identity assurance guidance increasingly emphasizes authentication methods that are resistant to phishing and replay, rather than adding more prompts to a brittle login pattern. For broader risk framing, ISO/IEC 27001:2022 Information Security Management pushes organisations to manage authentication as part of a wider access control system, not as a one-step fix.

• Replace shared-secret logins with phishing-resistant methods where possible.
• Use step-up checks for high-risk actions, not just at sign-in.
• Shorten session lifetimes and bind sessions to device or context.
• Harden password recovery, since recovery is often the weakest path.

NHIMG research on the State of Secrets in AppSec shows why shared secrets remain operationally expensive: leaked secrets can take an average of 27 days to remediate, even though most organisations believe their programs are strong. That gap between confidence and control is exactly what password-based access tends to amplify. These controls tend to break down in environments with legacy SSO bridges, shared administrative accounts, or SMS-based recovery because those paths reintroduce the very secrets the organisation is trying to avoid.

Common Variations and Edge Cases

Tighter authentication often increases user friction and help-desk load, so organisations have to balance usability against the cost of account takeover. That tradeoff is especially visible in regulated environments, customer-facing portals, and hybrid estates where older systems cannot support modern authenticators. Current guidance suggests that the answer is not “more factors everywhere,” but the right factors in the right places, with stronger controls reserved for privileged access and high-risk transactions.

There is no universal standard for phasing out passwords in every environment. Some systems still require them as a bootstrap credential, while others rely on them only during enrollment or recovery. The key exception is recovery: if password reset, fallback email, or service desk verification still depends on static knowledge, the organisation has preserved the original weakness. NHIMG incident analysis in DeepSeek breach and Twitter Source Code Breach shows how exposed secrets and weak identity paths can turn one compromised credential into much broader exposure.

For that reason, best practice is evolving toward removing passwords from primary access where possible, while treating recovery, support, and exception handling as first-class attack paths rather than administrative details.

Related resources from NHI Mgmt Group

• Why do password and SMS-based factors leave organisations exposed even when multi-factor authentication is enabled?
• Why do password-based controls remain a weak point for remote access security?
• Why do passwords remain a weak point even when organisations believe their identity controls are mature?
• How should organisations move away from password-based authentication without hurting user productivity?