Yubico and Okta recently collaborated on the 2026 Global State of Authentication Report, analyzing survey responses from almost 2,000 technology and security professionals across nine countries. The report reveals significant trends in enterprise security, comparing and contrasting authentication best practices in theory with what enterprises are actually doing.
Of the respondents to the survey, 43% state that they still use usernames and passwords in order to log in to work accounts, while 48% use this method for their personal accounts. The same group of surveyed security professionals collectively ranks passwords among the least secure methods of authentication.
Lack of Awareness Is Not the Problem
In response to the same question, 31% of global respondents rate hardware security keys as the most secure. In spite of this, only 25% use the top-rated method on work accounts, and 20% on personal accounts. Following hardware-backed passkeys in the rankings are mobile time-based one-time passwords (TOTPs) and push authenticator applications (29%), synced passkeys (27%), and mobile SMS-based authentication (25%).
When the survey results are broken down geographically, trends in answers from U.S. respondents are notable. The U.S. demonstrates a high level of awareness of the security of hardware-backed passkeys, with 40% of U.S. respondents ranking it as the most secure method. At the same time, the U.S. respondents show the highest rate of password dependency, with 50% using usernames and passwords at work and 56% at home.
Carrying Forward Default Credentials
The issue with username and password authentication does not entirely come down to individual decisions on the part of the users. Users inherit the weakness of this method and the particular credentials they’ve been issued, and often do not have the opportunity or option to switch to more secure methods. More than half of those surveyed (52%) were handed a traditional username and password combination at the time of onboarding, establishing a precedent that is easy to continue to follow. The first credential initially issued to the user becomes the lasting default.
Even passwords that are built to be too complex to guess and differ across separate logins can contribute to additional security risks. “Complex passwords may look secure on paper, but in practice, they’re reused, stored in spreadsheets, or shared over email because humans aren’t wired to remember dozens of combinations,” says Shane Barney, Chief Information Security Officer at Keeper Security, a Chicago-based provider of zero-trust and zero-knowledge cybersecurity software. “Attackers know that, and they exploit it every day.”
Fragmentation Keeping the Password Alive
There are a number of areas of disconnection within the enterprise that lead to the lasting use of default username and password credentials. According to the report, more than three-fourths (76%) of organizations use differing methods of authentication across internal applications, and 45% depend on usernames and passwords across systems. Nearly one in four (23%) organizations do not mandate the use of multi-factor authentication (MFA) on all enterprise applications and services.
This fragmentation can lead to clutter and an excess of different credentials that users need to know in order to log in to work-related applications and portals. This spurs on the use of password managers, relied on by 24% of users for work and 30% for personal use. Password managers are ranked as the least secure method of authentication, chosen by only 17% of respondents.
AI Phishing Increases the Risk
The rising use of generative AI by threat actors has driven an increase in AI-empowered phishing attacks, creating a massive volume of highly convincing messages to deceive targets. Of the respondents to the survey, 70% state that their organizations saw phishing increase over the past year, with 44% being hit by at least one AI-driven attack in the same time period. More than half (55%) have been personally targeted with tailored lures, and 22% even say they have received these targeted messages within the past week.
Vigilance Fails as the Fallback
Phishing defenses have always relied heavily on user awareness and training as a fallback for when tools and solutions fail to block suspicious messages. Many of the traditional signals of a phishing message—like spelling and grammar errors and incongruent levels of formality or familiarity—are based in the assumption that the message is being composed by a person. These assumptions are outdated in the era of AI-empowered phishing messages.
The shortcomings of traditional anti-phishing wisdom are borne out in the survey testing for human recognition of AI-generated text. Almost two out of every five (39%) survey respondents failed to identify which of two sample emails was written by AI, and 54% incorrectly identified a human-written question as being composed by AI. Human detection is no longer a dependable defense layer, even for experts; awareness training cannot close the security gap among professionals who are already aware.
Agentic AI Use Demands Improvements
The evolution from common use of generative AI to widespread implementation of agentic AI creates additional challenges for organizations. More than nine in ten (91%) respondents say that it is essential to keep human-in-the-loop approval prior to critical agent actions. This approval step can only work if the human user in question is properly verified and authenticated.
Relying on credentials that can be stolen through phishing undermines the safeguard. A bad actor can take advantage of less secure authentication methods, like traditional username and password combinations, to compromise an account that has the power to provide approval for agentic actions.
Securing agentic AI identities and the identities that manage and approve their activity is of the utmost importance. “As agentic AI takes on real business actions with real permissions, the attack surface expands in ways most organizations aren't prepared to see, let alone secure,” according to Chris Radkowski, GRC Expert at Pathlock, a Denver, Colorado-based identity and access security provider. “Credential abuse, account takeover, and sophisticated social engineering are increasingly targeting the non-human identities that operate quietly in the background with little oversight.”
Change the Default, Not the User
Individual user awareness can only go so far against advanced attacks and organization-wide authentication standards. In order to effectively secure authentication, it is crucial to issue users phishing-resistant credentials at onboarding, rather than traditional username and password combinations. Organizations are also encouraged to implement consolidated authentication across all applications to cut down on the fragmentation of different methods between systems. Progress is not measured by what is being taught to employees, but by what is being issued to them.
