Yubico and Okta survey: 43% of security professionals still sign in to work with passwords
In Yubico and Okta's 2026 Global State of Authentication survey of 1,890 technology and security professionals in nine countries, 43% said they sign in to work with a username and password, even though most rate passkeys as more secure. 52% were issued a password on their first day, 44% said their organization suffered an AI-driven attack in the past year, and 91% want a human approval step before AI agents take critical actions.
Talker Research ran the survey for Yubico and Okta between July 2 and July 16, 2026, polling 1,890 technology and security professionals at enterprises with more than 500 employees in the US, UK, Australia, India, Japan, Singapore, France, Germany and Sweden. The headline finding is a gap between knowledge and practice: 43% still log in to work with a username and password, even though respondents overwhelmingly see passkeys as safer. 31% named hardware passkeys as the most secure option, 27% synced passkeys and 23% device-bound passkeys on a phone.
The companies trace the habit to onboarding: 52% were handed a username and password when they started their current role. Password dependence was highest in the US, where 50% use passwords at work. Meanwhile, 44% said their organization suffered an AI-driven attack in the past 12 months, with Singapore highest at 58%, compared with 30% in Japan and 38% in Germany. In a test, 39% of the security professionals failed to tell AI-generated text from human writing.
On AI agents, 91% want a human-in-the-loop approval before autonomous agents execute critical actions. Yubico and Okta recommend issuing phishing-resistant authenticators during onboarding and enforcing them through sign-on policies, so strong login starts with the first sign-in, and say they are working together to make hardware-backed credentials easier to issue and manage through identity platforms.