Survey Shows 43% of Security Professionals Still Rely on Passwords Despite High Passkey Familiarity
What Happened – A joint Okta‑Yubico survey of 1,890 technology and security professionals across nine countries found that 43 % still use a traditional username + password to access work accounts, even though 87 % say they are familiar with password‑less “passkey” authentication. The same respondents reported frequent exposure to AI‑driven phishing and a low ability to distinguish human‑written from AI‑generated emails.
Why It Matters for Trust & Control Assurance
- Persistent password use creates a credential‑compromise surface that continuous control‑assurance programs must detect, document, and remediate.
- Phishing‑resistant authentication (e.g., passkeys) shifts the trust decision from a user‑readable email to a cryptographic key, providing defensible evidence of a hardened login process.
- Onboarding policies that issue passkeys instead of passwords generate audit‑ready proof of a “first‑sign‑in” security control, satisfying multiple framework objectives in one control area.
Who Is Affected – Enterprises that provision laptops and cloud SaaS accounts, especially technology vendors, security consultancies, and any organization with a sizable remote‑work workforce.
Recommended Actions
- Review your identity‑and‑access‑management (IAM) onboarding flow; replace default password issuance with passkey provisioning.
- Enforce multi‑factor authentication that includes a phishing‑resistant factor (e.g., biometric or hardware‑based).
- Capture and retain evidence of passkey enrollment and device‑health checks for audit readiness.
Technical Notes – The survey highlights two attack vectors: (1) password‑based credential theft via phishing (including AI‑generated lures) and (2 % + ) SMS‑based one‑time codes vulnerable to SIM‑swap attacks; (2) the lack of device health verification before session establishment, which can be exploited by compromised endpoints. Source: https://www.helpnetsecurity.com/2026/10/08/passkey-adoption-typing-passwords/