Security professionals rely on passwords despite passkey knowledge

A October 2026 joint study by Yubico and Okta found that 43% of security professionals still rely on passwords for work despite knowing passkeys are more secure, citing structural friction and legacy onboarding as primary barriers ^[1].

The report, titled the 2026 Global State of Authentication and conducted by Talker Research, was based on a survey of nearly 2,000 technology and security professionals across nine countries [1, 3]. The findings suggest that enterprises are attempting to solve architectural security problems with human education, even though 88% of security leaders express confidence in their organization's current security posture ^[1].

The Security Execution Gap: Knowledge vs. Practice

The data shows a disconnect between the domain expertise of security leaders and their actual daily habits. While 87% of the surveyed professionals are familiar with passkeys and 31% identify device-bound, hardware-backed passkeys—specifically hardware security keys—as the most secure credential available, nearly half continue to use vulnerable login methods [1, 3].

"The gap isn't expertise; it's overcoming the friction to user adoption," said Poupak Enbom, Chief Market and Growth Officer at Yubico ^[3]. Enbom noted that this "critical execution gap" persists because security leaders recognize the superiority of hardware-backed protection but still rely on basic usernames and passwords in their daily routines ^[3].

Structural Friction and the Legacy Onboarding Trap

This reliance on passwords often begins at the start of employment. More than half of respondents, or 52%, received username-and-password credentials when they started their roles, establishing a password dependency by default ^[1]. Charlotte Wylie, SVP and Deputy Chief Security Officer at Okta, who oversees global engineering teams for nearly 19,000 customers, stated that bridging this gap requires organizations to build security directly into the onboarding experience [1, 3].

Beyond onboarding, operational fragmentation maintains these habits. The survey found that 76% of organizations use fragmented authentication methods across different internal applications, and 45% use usernames and passwords across those systems ^[1]. This combination of insecure defaults and constant security prompts triggers authentication fatigue, leading users to choose the easiest path regardless of training ^[1].

This structural friction creates productivity costs and encourages risk. IBM reports that completing an MFA (multi-factor authentication) challenge takes an average of 3 minutes, while password resets cost enterprises about $70 each ^[2]. According to a CyberArk Identity Security Threat Landscape Report cited by Twosense, 65% of employees admit to bypassing security to stay productive ^[2].

The AI Threat: Why Human Vigilance Is No Longer Enough

Structural failures are becoming more dangerous as generative AI renders traditional employee training obsolete. In the past year, 70% of respondents noted an increase in organizational phishing, and 44% reported that their organization suffered at least one successful AI-driven attack ^[1]. Additionally, 43% of respondents experienced suspicious voice, video, or phone impersonations targeting clients or executives ^[1].

AI has made visual indicators like typos and awkward phrasing obsolete, making it difficult for even experts to spot synthetic content. In a test conducted by Okta and Yubico, only 36% of security professionals correctly identified human-written messages over AI-generated ones ^[1]. Consequently, the researchers argue that organizations can no longer rely on employee vigilance and must shift toward architectural enforcement that secures authentication by default ^[1].

Governing the Next Wave: AI Agents and Human Oversight

As workforces delegate tasks to autonomous AI agents for routine scheduling (35%) and drafting internal communications (35%), the focus is shifting toward machine identity ^[1]. Security leaders recognize the risk, with 91% saying that verifying AI agent identity is essential and 57% calling it critical ^[1].

Generational differences appear in how this delegation is viewed. Gen Z professionals are 68% comfortable letting an AI agent communicate with clients, compared to only 27% of Baby Boomers ^[1]. This suggests the next generation of workers will be more likely to delegate work to AI agents ^[1].

To mitigate risk, 91% of respondents insist on a "human-in-the-loop" approval step before an agent performs high-stakes actions, such as executing financial transactions or escalating privileges ^[1]. This ensure that while authentication remains automated to prevent error, human oversight remains for critical actions ^[1].

Moving Toward Invisible, Continuous Authentication

To eliminate the trade-off between security and friction, some firms are moving toward behavioral verification. Twosense claims its continuous authentication system can stop intrusions in under a minute by detecting behavioral mismatches, such as typing patterns and mouse movements, in the background ^[2].

This approach aims to remove the need for manual codes or hardware tokens that can be lost, shared, or broken ^[2]. Unlike traditional MFA, which verifies identity once per login, this system provides real-time security every second ^[2]. "When legacy login habits persist, enterprises remain vulnerable to modern attack vectors," said Charlotte Wylie ^[3].

What we don't know

• Which nine countries were included in the Global State of Authentication survey?
• What specific components make up the "modern identity framework" proposed by Okta and Yubico beyond the use of phishing-resistant authentication and its three phases (before, during, and after login)?