Your frontline workers have a workaround for that MFA prompt

Your frontline workers have a workaround for that MFA prompt Frontline workers in healthcare and manufacturing are getting around slow, unreliable logins by staying signed in, sharing credentials and trying to bypass multifactor authentication. Sapio Research surveyed 700 IT and security decision-makers in August, and 95% said they had seen frontline workers use workarounds like these in the past 12 months. Each of those habits breaks the link between an account and the person using it. A session left open on a shared workstation lets the next worker act under someone else’s name, and a password passed around a team lets anyone who knows it do the same. Attackers are working the same weak point from outside. Sixty-two percent of respondents reported a confirmed or suspected attempt to abuse account recovery, a password reset or an unlock in the past year. Logins eat hours each month The respondents work at organizations with 500 or more employees in the US, UK, France and Germany. On average, they estimate that 37% of their frontline workers hit an authentication problem in a typical month, and that each affected worker loses about 2.5 hours a month to it. Respondents spread the blame across many causes. Logging in while wearing gloves or protective equipment tied for the most-cited challenge with delays switching between devices and between users on shared devices. Password resets, connectivity failures and repeated MFA prompts sit just behind, and the top nine challenges land within six percentage points of each other. If you were hoping one fix would clear the queue, the data offers no candidate. Attackers go after the reset That 62% counts suspicions alongside confirmed cases. Confirmed cases alone come to 28% of organizations, which still means more than one in four can point to a specific unauthorized attempt to recover, reset or unlock an account. Recovery is the step where a worker who has lost access proves who they are, usually to a service desk, and anyone who can fake that proof walks away with a working account. Organizations check identity at that step in many different ways. Respondents named employee badges, email, SMS codes, biometrics and manager approval, and none of those methods is used by a majority. At the same time, 48% said they are very or extremely concerned about AI-enabled impersonation, the same share that worries about conventional social engineering. A help desk that verifies callers by email or text message is leaning on channels an attacker can take over. Half the passkey users kept the password Passkeys, login credentials stored on a device and bound to the real site so a fake page cannot capture them, are in use at 28% of the organizations surveyed. Nearly half of those organizations, 45%, still keep a password alongside them. Other passwordless methods bring their own exposure. SMS codes, authenticator app codes and push approvals remove the typed password but can still be phished. Among the 261 organizations relying on those methods, 37% confirmed an unauthorized recovery, reset or unlock attempt, compared with 28% across the full sample. Organizations caught partway through the switch also see more workaround behavior. Those running a mix of password and passwordless methods reported credential sharing at twice the rate of organizations where passwordless login leads. Workers in those mixed setups may have to deal with both systems each time a device changes hands. “The research shows frontline organizations don’t have to trade speed for security. Those using passkeys report productivity gains from a method that is phishing-resistant by design, and many are planning to expand their use,” said Andrew Shikiar, executive director and CEO of the FIDO Alliance. A leftover password is still something a caller can talk a service desk into resetting. That route stays open at nearly half the organizations that have already deployed the stronger credential, and 60% of respondents said their service desk faced a confirmed or suspected social-engineering attempt in the past year. Download eBook: Identity-First Threat Intelligence