With cyberattacks increasing in number, intensity, and complexity, there are continual calls for a better way of authentication than passwords. Every year, there is a prediction that the next year will finally be the one in which we see password-less computing.
According to the World Economic Forum, 80% of breaches are perpetrated from weak and stolen passwords. The Forum argues that for larger businesses, nearly 50% of IT helpdesk costs are allocated to password resets, with the average annual spend for companies now at over $1 million for staffing alone. Research by IBM suggests the average cyberattack costs $3.86 million. And yet the use of passwords as the principal means of authentication continues, despite passwords being very difficult to secure and companies struggling to process and store them securely.
Go deeper with GlobalData
So-called credential stuffing attacks, which use stolen credentials, are now so common that over 90% of all login attempts on major retail sites are malicious, with average success rates of around 1%.
New authentication technologies
In 2020, the Forum produced a report in collaboration with the FIDO Alliance, which introduced five password-less authentication technologies, which they claimed were ‘ready’ for implementation by global companies. These were biometrics, behavioural analytics, zero-knowledge proofs, QR codes, and security keys.
Nearly two years on from the launch of that report, there has been some password-less progress. In September 2021, Microsoft declared that users can now completely remove a password from their Microsoft account, instead of using the Authenticator app, Windows Hello, a security key, or a verification code sent to a phone or email to sign in to apps and services such as Outlook and OneDrive.
Many people are already using biometric authentication—either by TouchID or increasingly via FaceID—when they use their mobile. But organizations are still largely using passwords.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataPhishing
The majority of cyberattacks use phishing methods, in which an attacker aims to deceive a user into compromising their login credentials. Greater adoption of password-less authentication would mean employees are not duped into providing any sensitive information to threat actors when they receive a phishing email.
In general, users prefer password-less authentication because it is faster to use and they do not have to remember a complicated password. The process is seamless, and security professionals also prefer it because it is more secure than password authentication, as there is no password to steal.
With employees continually being asked to generate more complex passwords, the process has become more and more demanding. Enterprises suffer significant costs in dealing with passwords. Whether it is forgotten passwords, loss of productivity, or disgruntled customers, passwords have become a headache that enterprises could really do without.
Conservative decision-making
The problem with password-less authentication is that it demands a new approach for organizations, who are typically conservative. Password-less authentication, while offering significant security benefits, is likely to be challenging to implement. IT organizations are likely to be reluctant to move away from traditional security methods and try new ones. Change is hard, and it typically requires time, training, and money—which is usually in short supply, even more so post-pandemic. The easy decision is to put off the change and consider password-less for another day.
In a year’s time, as we look back on 2022 and ahead to 2023, you would hope to have seen more adoption of password-less authentication. Both 2020 and 2021 have been difficult years in cybersecurity and it is time for a change.
Related Company Profiles
Microsoft Corp