Survey: 95% of IT Leaders See Frontline Workers Bypassing MFA Security Controls
A new survey reveals that frontline staff in healthcare and manufacturing routinely bypass MFA to overcome slow logins, creating significant identity verification gaps.
Key points
- % of surveyed IT decision-makers reported frontline workers using authentication workarounds in the past year.
- % of organizations experienced attempts to abuse account recovery or password reset processes.
- Frontline workers lose an average of 2.5 hours monthly to authentication failures and related issues.
Frontline employees in healthcare and manufacturing sectors are increasingly bypassing multifactor authentication (MFA) to overcome slow or unreliable login processes, according to a survey by Sapio Research. The study, conducted in August among 700 IT and security decision-makers, found that 95% of respondents had observed workers using workarounds such as staying signed in or sharing credentials within the past 12 months.
These practices sever the critical link between a specific user and their digital identity. When workers leave sessions open on shared workstations or distribute passwords among teams, it becomes impossible to determine who performed which action. This ambiguity creates a vulnerability that external attackers are actively exploiting, with 62% of respondents reporting confirmed or suspected attempts to abuse account recovery, password resets, or account unlocks over the same period.
Operational Friction and Identity Risks
The survey respondents represent organizations with at least 500 employees located in the US, UK, France, and Germany. On average, these organizations estimate that 37% of their frontline workforce encounters an authentication problem in a typical month. Each affected worker loses approximately 2.5 hours per month dealing with these issues. The root causes are varied, with logging in while wearing gloves or protective equipment tying for the most-cited challenge alongside delays when switching between devices or users on shared terminals.
Password resets, connectivity failures, and repeated MFA prompts also rank highly as friction points. The top nine challenges identified in the survey fall within six percentage points of each other, indicating that no single technical fix will resolve the underlying usability issues. This distributed blame suggests that authentication friction is a systemic problem rather than an isolated configuration error.
Exploitation of Recovery Processes
The 62% figure for abuse attempts includes both confirmed incidents and suspicions. Confirmed cases alone account for 28% of organizations, meaning more than one in four can point to a specific unauthorized attempt to recover, reset, or unlock an account. Account recovery is a high-risk step where a worker proves their identity, typically to a service desk, to regain access. If an attacker can fake this proof, they gain a fully functional account.
Organizations use various methods to verify identity during this step, including employee badges, email, SMS codes, biometrics, and manager approval. None of these methods is used by a majority of respondents. Meanwhile, 48% of respondents expressed high concern about AI-enabled impersonation, matching the level of worry regarding conventional social engineering. Relying on email or text for verification leaves help desks vulnerable to channel takeover by attackers.
What should you do?
Security teams should review logs for unusual account recovery requests or password resets, particularly those originating from shared devices or outside normal working hours. Organizations should evaluate their current identity verification methods for account recovery, ensuring they do not rely solely on easily compromised channels like SMS or email. Training should reinforce the risks of credential sharing and session abandonment, while IT departments should investigate the root causes of authentication friction to reduce the incentive for workarounds.
Background: Social engineering
Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.
Read the full guide: Social Engineering Warning Signs and How to Respond
What to do and how to stay safe: Sapio Research
- Audit account recovery logs for anomalies such as multiple reset requests or requests from unfamiliar locations.
- Strengthen identity verification for account recovery by requiring multi-channel proof that cannot be easily spoofed.
- Investigate and resolve technical causes of authentication delays to reduce the incentive for workers to bypass security controls.
- Monitor for signs of credential sharing, such as concurrent sessions from different geographic locations using the same account.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What percentage of IT leaders reported seeing MFA workarounds?
According to the Sapio Research survey, 95% of IT and security decision-makers reported seeing frontline workers use authentication workarounds in the past 12 months.
How much time do workers lose to authentication issues?
Respondents estimate that each affected frontline worker loses about 2.5 hours a month to authentication problems.
What is the most common challenge causing login friction?
Logging in while wearing gloves or protective equipment tied for the most-cited challenge, along with delays switching between devices or users.
