Challenges and Progress in Enterprise Passwordless Authentication
Enterprises are increasingly adopting passwordless authentication methods such as biometrics, passkeys, and security keys to enhance security and reduce the risks associated with traditional passwords. However, widespread implementation remains difficult, particularly for legacy systems, operational technology, and specialized applications that were never designed for anything other than passwords. Security leaders report that while most organizations can cover the majority of their threat landscape with passwordless solutions, the final 15%—often the most critical and legacy-dependent systems—remains resistant to change, creating operational and security challenges.
Major technology providers like Google are actively promoting passwordless authentication, urging users to adopt passkeys and stronger authentication tools in response to increasingly sophisticated phishing and vishing attacks. Despite these efforts, the transition is hampered by technical, operational, and user experience hurdles, and attackers are exploiting gaps between multiple authentication systems. The push for a passwordless future is ongoing, but experts caution that full adoption may never be realized, and organizations must remain vigilant against evolving credential-based threats.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Organizations increase use of SSO and passkeys to address weak password practices
Subsequent reporting described organizations adopting single sign-on and passkeys to reduce reliance on weak or reused passwords and improve identity security. The shift was presented as a practical response to persistent bad password habits rather than a total replacement of legacy authentication.
Industry reporting notes passwordless adoption will be partial, not absolute
Analysis published around the same time emphasized that a fully passwordless future is unlikely to arrive universally, with many environments expected to retain passwords alongside newer authentication methods. This reflects a broader recognition of technical, operational, and user-adoption limits.
Google begins promoting passwordless sign-ins for Gmail and accounts
Google's latest security push highlighted passkeys and other passwordless sign-in methods for Gmail and Google accounts, signaling a broader move away from traditional passwords. The reporting frames this as an ongoing transition rather than a complete end to passwords.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Orgs Move to SSO, Passkeys to Solve Bad Password Habits
darkreading.com
Open sourceYour passwordless future may never fully arrive
csoonline.com
Open sourceGoogle’s Latest Security Push Marks the Slow Death of Passwords
techrepublic.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprise Struggles and Trends in Customer Authentication Security
Organizations continue to rely heavily on passwords for customer authentication, despite widespread recognition that these methods are both insecure and detrimental to user experience. Research from Descope highlights a persistent gap between security leaders’ stated priorities and the authentication technologies actually deployed, with 87% of organizations still using passwords as a primary method. While most companies claim to use multi-factor authentication (MFA), coverage is inconsistent, leaving exploitable gaps for attackers. The transition to more secure options like passkeys is hindered by technical debt, resource constraints, and internal misalignment, even as over 70% of organizations plan to adopt such technologies. Industry experts and practitioners are debating whether passwordless authentication is ready for widespread adoption or if it simply introduces new challenges. The evolution of identity management now includes managing non-human identities, implementing privilege access management, and adopting risk-based authentication. Security leaders are urged to align MFA, governance, and zero trust principles to resist account takeover and policy drift, but practical barriers remain in rolling out modern authentication at scale. The consensus is clear: while the future of authentication is moving beyond passwords, organizations face significant hurdles in making this transition both secure and user-friendly.
Jun 29, 2026
Corporate Security Risks and the Shift Toward Passwordless Authentication
A new report from password manager 1Password highlights that weak or compromised passwords remain a significant security risk for organizations, with employee password practices worsening despite increased awareness. Survey data from over 5,000 workers across multiple countries reveals that a majority of employees, including IT professionals, continue to reuse passwords, rely on default credentials, or share passwords via insecure channels, exacerbating the threat landscape for businesses. The report underscores that even as companies move toward passwordless authentication, the transition is gradual and current credential management practices are not keeping pace with evolving threats. In response to these challenges, technology vendors are accelerating the adoption of passwordless solutions. Microsoft has released Edge version 142.0, introducing cross-platform passkey synchronization, allowing users to securely reuse passkeys across devices and browsers. This feature, which requires a dedicated PIN for access, aims to enhance both security and usability, reducing reliance on traditional passwords. The move reflects a broader industry trend toward passkeys and multi-factor authentication as default options, with major platforms like Google and Meta also embracing passwordless technologies to mitigate the risks associated with password-based authentication.
Jun 29, 2026
Advancements in Passwordless Authentication and Identity Security
Organizations are increasingly moving towards passwordless authentication methods, with technologies such as passkeys and device identity gaining traction as more secure alternatives to traditional passwords and multi-factor authentication (MFA). Passkey authenticators, often integrated into password managers or as standalone components, play a critical role in enabling seamless and secure login experiences by leveraging new standards and cryptographic techniques. Device identity further enhances security by binding credentials to hardware, making authentication resistant to phishing and social engineering attacks, while also improving user experience by reducing prompt fatigue and streamlining access to applications and networks. The identity security market is also witnessing strategic acquisitions, such as Ping Identity's purchase of Keyless, which aims to integrate privacy-preserving biometric authentication for frontline workers and address emerging threats like deepfakes. These moves reflect a broader industry trend towards comprehensive identity lifecycle management, resilience against AI-driven threats, and scalable support for both human and machine identities. As economic constraints limit large-scale mergers, the focus is shifting to targeted acquisitions that expand platform capabilities and reinforce the shift to passwordless, device-centric authentication models.
Jun 29, 2026