Survey: Half of Security Pros Still Use Passwords Despite Risks
A Yubico survey reveals a persistent gap between awareness of authentication risks and the adoption of stronger security methods in enterprises.
Key points
- % of cybersecurity professionals still rely on passwords for authentication.
- Yubico data highlights a significant disconnect between security awareness and practice.
- Enterprises continue to lag in adopting more secure authentication methods.
Cybersecurity professionals are continuing to rely on passwords for authentication at high rates, despite widespread awareness of the associated security risks. According to a survey conducted by Yubico and reported by Infosecurity Magazine, half of security experts still use passwords as their primary method of accessing systems.
The findings underscore a persistent gap between the theoretical understanding of secure authentication and its practical implementation within enterprises. While security leaders recognize the vulnerabilities inherent in password-based systems, the transition to more robust methods remains incomplete. This reliance on legacy authentication mechanisms leaves many organizations exposed to credential-based attacks, even among those tasked with protecting digital infrastructure.
The Awareness-Adoption Gap
The survey results indicate that knowledge of security best practices does not automatically translate into behavioral change. Infosecurity Magazine noted that the data identifies a significant discrepancy between what security professionals know about authentication risks and what they actually do in their daily operations.
This lag in adoption suggests that barriers to implementing stronger authentication methods may extend beyond technical feasibility. Organizational inertia, user convenience, and legacy system compatibility often play roles in slowing the shift away from passwords. For security teams, this creates a challenging environment where they must advocate for improved security postures while navigating existing operational constraints.
Who Is Affected
The primary group affected by this trend is the enterprise sector, particularly within IT and security departments. The survey specifically targeted cybersecurity professionals, indicating that the issue is prevalent even among those who should be leading the charge for stronger security measures.
If security experts are still using passwords, it is likely that broader employee bases are doing the same. This widespread reliance on weak authentication factors increases the attack surface for organizations, making them more susceptible to phishing, brute-force attacks, and credential stuffing. The persistence of password use represents a systemic risk that extends beyond individual user habits to organizational security culture.
What should you do?
Organizations should assess their current authentication practices to identify where passwords remain the sole factor for access. Security teams can begin by reviewing administrative accounts and privileged access points to ensure stronger controls are in place. Monitoring for unusual login activity can help detect potential compromises resulting from weak credentials.
Background: Security culture
Security culture is the collective behavior and attitudes of an organization toward protecting information. It is not a policy document but the daily practice of balancing convenience with safety. It determines if employees bypass controls or report anomalies, directly impacting the effectiveness of your technical defense stack.
Read the full guide: Security Culture Definition: Why Policies Fail Without Shared Behavior
What to do and how to stay safe: Yubico
- Audit current authentication methods to identify reliance on single-factor password access.
- Evaluate the feasibility of implementing multi-factor authentication for all user accounts.
- Monitor logs for suspicious login attempts or credential-based anomalies.
- Educate staff on the risks of password reuse and the benefits of stronger authentication options.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of security professionals still use passwords?
According to the Yubico survey, half of cybersecurity professionals still rely on passwords for authentication.
Who conducted the survey?
The survey was conducted by Yubico and reported by Infosecurity Magazine.
What does the survey reveal about enterprise security?
It reveals a significant gap between the awareness of security concerns and the actual adoption of secure authentication methods in enterprises.
