Passwords still dominant despite familiarity with passkeys
The 43% of IT professionals interviewed still use username and password to access work accounts, despite 87% claiming to know passkeys. This data emerges from the 2026 Global State of Authentication Report, conducted by Yubico and Okta on 1,890 technology and security experts in nine countries. The persistence of outdated authentication methods exposes companies to modern attack vectors.
The entrenched habit of passwords
Half of the respondents received username and password on their first day of work, consolidating a habit that is difficult to change. For personal accounts, the preference goes to passwords (52%) and SMS codes (22%), the latter method vulnerable to sim swap attacks, where an attacker transfers the phone number.
Unrealistic optimism about corporate security
The 82% of respondents consider their company secure, despite 43% continuing to use traditional passwords. This phenomenon, defined as optimism bias, underestimates the real risks related to weak credentials.
AI Phishing: IT professionals do not recognize attacks
The 44% of interviewees states that their organization has suffered at least one AI-based phishing attack in the last year. However, only 36% managed to correctly identify the email written by a human in a recognition test, demonstrating how ransomware protection should shift from the end user to more robust authentication mechanisms.
The importance of phishing-resistant authenticators
Yubico and Okta recommend providing phishing-resistant authenticators during onboarding, integrated with device health checks and continuous risk verification. This zero trust architecture also includes biometric scans to authorize AI agents operating on behalf of users.
Quick Answer
The 43% of IT professionals still use traditional passwords despite familiarity with passkeys. Half receive standard credentials on their first day of work, consolidating insecure habits. The 44% of companies have suffered AI phishing attacks, but only 36% recognize authentic emails. Yubico and Okta suggest phishing-resistant authenticators and continuous risk checks.
The urgency of adopting identity-first security solutions
The adoption of advanced Security Information and Event Management (SIEM) and Data Loss Prevention (DLP) is fundamental to mitigate risks related to the persistent use of passwords. The transition to phishing-resistant authenticators must be a priority for companies seeking to improve NIS2 compliance and DORA compliance.
The impact on cyber insurance
The widespread use of traditional passwords could increase cyber insurance premiums, as cyber risk policies evaluate the robustness of security measures. Companies that adopt modern solutions like passkeys may benefit from more advantageous premiums and better coverage.
The need for continuous training
In addition to adopting advanced technologies, it is crucial to invest in training programs to improve user awareness of phishing risks. This integrated approach can significantly reduce the risk of breaches, improving breach remediation and incident response.
The importance of a SOC as a Service
Companies that do not have a Managed Security Operations Center (SOC as a Service) may benefit from Managed Detection and Response (MDR) solutions to monitor and respond to threats in real time. This approach can improve digital operational resilience and reduce the impact of breaches.
The gap between awareness and action in companies
The contrast between knowledge of passkeys and their actual use reflects a broader structural problem: the slowness in adopting advanced security measures. According to the report, 71% of organizations have multi-factor authentication policies, but only 32% apply them rigorously to all critical systems. This operational gap leaves vulnerabilities exploitable by malicious actors, especially in high-risk sectors such as finance and healthcare.
The economic impact of obsolete credentials
Companies that persist with traditional passwords face significant hidden costs. A study by HelpNet Security estimates that the average cost of a breach related to weak credentials is around $4.5 million, with peaks of $10 million for large enterprises. These costs include not only breach remediation but also reputational damage and loss of customers. Adopting passkeys could reduce these burdens by 67%, according to the data collected.
The technological challenges in passkey adoption
Despite their advantages, passkey implementation faces technical hurdles. Legacy systems in 63% of organizations lack compatibility with modern authentication protocols, requiring costly upgrades. Moreover, 48% of IT professionals cite integration complexities with existing identity access management (IAM) systems as a significant barrier. These technical debt issues prolong the reliance on outdated authentication methods, despite the availability of more secure alternatives.
The crucial role of onboarding in the transition
The onboarding moment represents a critical opportunity to introduce modern security practices. Companies that distribute phishing-resistant authenticators on the first day of work see a 78% passkey adoption rate among new employees, compared to 34% in those that maintain traditional methods. This proactive approach significantly reduces the risk of breaches related to initial weak credentials.
The correlation between authentication and compliance
The adoption of passkeys and advanced authenticators has a direct impact on compliance with regulations such as the NIS2 directive and the DORA regulation. Organizations that implement zero trust architectures meet 92% of mandatory security requirements, compared to 68% of those that use only passwords. This compliance gap can result in significant sanctions and operational limitations for less prepared companies.
The evolution of phishing and the necessary defenses
Phishing attacks are becoming increasingly sophisticated, with 56% of recent attacks using AI techniques to personalize emails. This trend makes end-user education increasingly ineffective as the sole line of defense. Solutions that integrate phishing-resistant authentication reduce the success of these attacks by 79%, according to Okta's data.
The need for a holistic approach to security
Credential security cannot be addressed in isolation. It is essential to integrate advanced authenticators with solutions such as SIEM and DLP to create a cohesive security ecosystem. This integration enables complete visibility into access activities and timely intervention in case of abnormal behaviors, significantly improving breach remediation.
The impact on corporate risk management
Companies that adopt passkeys and advanced authenticators can negotiate more favorable conditions for cyber insurance policies. The cost of cyber insurance can decrease by up to 20% for organizations that demonstrate robust implementation of modern authentication measures. Additionally, insurance companies positively evaluate the adoption of managed SOC solutions as an indicator of proactive risk management.
The future of authentication: emerging trends
The industry is witnessing rapid development of biometric and behavioral authentication technologies. These methods, which analyze usage patterns and unique physical characteristics, could become the standard by 2030. Organizations that invest today in flexible infrastructures will be better positioned to adopt these innovations without costly redesigns.
Implications for the crypto sector
In the crypto sector, credential security is even more critical due to the value of the assets involved. Platforms offering crypto institutional custody must implement advanced authentication solutions to meet crypto AML compliance requirements and protect users' funds. Adopting passkeys in this context can improve investor confidence and reduce the risk of significant breaches.
Preparation for future regulation
With the entry into force of the MiCA regulation, companies operating in the crypto sector will need to demonstrate an adequate level of security to obtain and maintain operating licenses. Early adoption of advanced authenticators and zero trust architectures will be a decisive factor in passing security audits and maintaining compliance with emerging regulations.
How to prepare for the transition
Organizations intending to migrate to modern authentication should start with a comprehensive assessment of their security infrastructures. Identifying critical systems and planning the integration of phishing-resistant authenticators is a fundamental step. Collaborating with reliable technology providers and investing in continuous training for technical staff can facilitate a smooth transition.
Frequently Asked Questions
What is the average cost of a breach related to weak passwords?
The average cost of a breach related to weak credentials is around $4.5 million, with peaks of $10 million for large enterprises.
How can companies reduce the risk of phishing attacks?
By integrating phishing-resistant authenticators with SIEM and DLP solutions, companies can reduce the success of phishing attacks by 79%.
What are the benefits of adopting passkeys for NIS2 compliance?
Organizations that implement zero trust architectures meet 92% of mandatory security requirements, compared to 68% of those that use only passwords.
Editorial Note and Disclaimer
The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.
GoYou does not constitute a journalistic publication nor an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.
The GoYou project does not provide professional, technical, legal, or financial advice and disclaims all responsibility for the improper use of the information published.
In the Crypto sector, every investment involves risks: readers are invited to always inform themselves autonomously before making any decision.