Recent research conducted by Yubico and Okta has revealed that a significant portion of cybersecurity professionals—48% to be precise—still depend on traditional usernames and passwords for authenticating their personal accounts. Surprisingly, this authentication strategy remains the most prevalent method utilized by security experts, with 43% utilizing it to access their work accounts. Such reliance on a method generally deemed insecure underscores what experts refer to as an “execution gap” in enterprise security practices.
Despite acknowledging that usernames and passwords are among the least secure authentication methods available, cybersecurity professionals continue to use them extensively. This paradox suggests that the problem may not be merely one of awareness; operational friction may play a significant role in perpetuating outdated security practices. According to the study, a substantial 76% of respondents reported that their organizations employ fragmented authentication methods across various internal applications, while 23% confessed that multifactor authentication (MFA) is not mandated across all enterprise applications and services. This inconsistency in authentication protocols sheds light on the systemic issues that hinder the implementation of more secure practices.
Interestingly, even though hardware-backed passkeys were identified as the most secure form of authentication, only 25% of respondents employed this method for work accounts and 20% for their personal accounts. The findings point to a reluctance among even the most knowledgeable professionals to adopt advanced security measures, possibly due to concerns about “login friction” or the fear of being locked out of their accounts. This behavioral tendency is further underscored by the fact that over half of the 2,000 cybersecurity professionals surveyed were issued traditional username and password credentials upon starting their roles, which may have fostered legacy habits that are difficult to break.
Additionally, password managers were found to be in use by 24% of respondents for work-related accounts; this figure rises to 30% for personal accounts. Nevertheless, a notable portion of security professionals continues to utilize less secure methods such as one-time mobile passcodes and SMS-based authentication. Both of these methods have been shown to be vulnerable to interception by malicious actors, raising significant concerns about the overall effectiveness of such strategies.
Furthermore, the report, released on October 7, also draws attention to the rising threat of social engineering attacks fueled by advancements in artificial intelligence (AI). Nearly half of the respondents—44%—reported that their organizations had fallen victim to at least one AI-driven phishing attack in the past year. This rising trend appears to be corroborated by an alarming 70% of security professionals who noted an increase in phishing attacks targeting their organizations over the same timeframe. Notably, 55% of them said they were victims of personalized attacks designed to manipulate them directly.
The increasing sophistication of these attacks is attributed, at least in part, to the capabilities of AI. Cybercriminals are harnessing generative AI tools to enhance the scope and intricacy of their phishing campaigns. This situation highlights a concerning trend, as the use of deepfakes in social engineering efforts has also gained traction. The report indicates that 43% of organizations have reported encountering suspicious video, voice memos, or even phone impersonations targeting executives or clients. Moreover, approximately a third—29%—of security professionals indicated that they themselves had been specifically targeted by deepfake communications.
The findings from Yubico and Okta’s report serve as a wake-up call to the cybersecurity community. While there is a clear recognition of the deficiencies in traditional authentication methods, the gap between awareness and implementation continues to widen, hampered by structural challenges within organizations. This evolving landscape, highlighted by the increasing prevalence of AI-driven attacks, necessitates a reevaluation of security protocols and a push for more robust, secure authentication methods. As the threat landscape continues to adapt and evolve, so too must the strategies employed by security professionals to protect sensitive information and maintain the integrity of organizational cybersecurity practices.