The people who know passkeys best are still typing passwords
Yubico and Okta found 43% of security professionals still sign in with passwords despite knowing passkeys.
Yubico and Okta surveyed 1,890 technology and security professionals across nine countries for a 2026 authentication report. Forty-three percent still use a username and password for work accounts even though 87% said they knew passkeys, and 52% were issued a password at onboarding. Forty-four percent believed their organization had suffered at least one successful AI-driven phishing attack in the past year, a self-reported figure rather than a measured breach rate. Only 36% correctly distinguished a human-written HR email from an AI-generated one.
- 43% of respondents still sign in to work with a password.
- 87% said they were already familiar with passkeys.
- 52% were issued a password when they started.
- 44% reported at least one successful AI phishing attack.
- Only 36% correctly identified the human-written HR email.
Full article453 words · extracted from helpnetsecurity.com · click to collapse
Yubico and Okta asked 1,890 technology and security professionals across nine countries how they sign in to work accounts. The most common answer was a username and password, at 43%, from a group in which 87% said they were familiar with passkeys.
High familiarity with modern authentication (Source: 2026 Global State of Authentication Report)
The password comes with the laptop
Half of respondents were issued a username and password when they started their current role. The report’s authors argue that whatever IT hands out on day one is what people keep using. On their personal accounts, these professionals lean on passwords first and text-message codes second. Text-message codes carry their own risk: an attacker who talks a mobile carrier into moving a phone number gets the codes too.
“When legacy login habits persist, enterprises remain vulnerable to modern attack vectors,” said Charlotte Wylie, SVP Deputy CSO at Okta.
The respondents rate their own employers generously anyway. Most described their enterprise as secure, a verdict that sits next to the 43% still signing in with a password. Researchers call that optimism bias, the belief that expertise protects you from bad outcomes.
Experts misread the test emails
Respondents supplied the phishing numbers themselves. Forty-four percent said their organization suffered at least one successful AI-driven phishing attack in the past year. About as many said they had none, and the rest weren’t sure. Treat that figure as what respondents believe happened at their companies, not a measured breach rate.
The researchers also ran a test. They showed respondents two HR emails announcing an updated employee handbook, one written by a person and one generated by AI, and asked which was which. Only 36% correctly picked the human one. Most of the rest thought AI had written it, and a few weren’t sure.
If you take one thing from that test, it is how little a careful reader can learn from the text of an email. A phishing-resistant login moves the check from the reader’s eye to the key, which confirms the site’s domain before anything is sent. A fooled employee still can’t hand over a working credential.
What the companies want changed
Yubico and Okta want phishing-resistant authenticators issued to new hires during onboarding, so strong login starts at the first sign-in, and enforced through application sign-on policies. They also call for device health checks before a session opens and ongoing risk checks after it. That includes a key touch or biometric scan before an AI agent carries out work on a person’s behalf.
The IT desk that sets up a new hire’s laptop makes the first call, and for 52% of these respondents, it handed over a password.
Download eBook: Identity-First Threat Intelligence