The Case Against Passwords

Picture a Monday morning at 8:47 AM. The IT helpdesk queue already has fourteen tickets, and twelve of them say some version of the same thing: "My password isn't working." One employee tried their old password after a mandatory 90-day rotation. Another locked themselves out after three failed attempts. A third swears they never changed it, but the system disagrees. Somewhere in the building, a senior director is on the phone with IT, unable to open the board deck ten minutes before the meeting.

That scene is a composite, not a single company's log. Anyone who has run IT will recognize it. It is so common that most organizations have stopped questioning it. Passwords are simply the cost of doing business, or so the thinking goes.

What if that assumption is not just wrong but actively dangerous? What if the mechanism we rely on to protect our most sensitive systems is the largest attack surface we voluntarily maintain?

This chapter makes the case, with sourced data, real breaches and the economics, for why the era of passwords must end. The alternative is not a distant future technology. It is deployable today.

The Scale of the Password Problem

People manage far more accounts than they can remember strong, unique passwords for. Knowledge workers juggle SaaS applications, internal tools, VPN credentials, database access and cloud consoles. Each account typically demands a unique, complex password, a rule that almost no human being actually follows.

Credential abuse led Verizon's Data Breach Investigations Report (DBIR) as the top way attackers get in for years: 22% of breaches in the 2025 edition. In the 2026 DBIR, vulnerability exploitation overtook it at 31% of breaches, with credential abuse at 13%. That is not a sign passwords got safer. Attackers are taking the faster path through unpatched systems, and stolen credentials still feed phishing, ransomware and account takeover long after the initial breach.

The numbers that matter most for this book:

Metric	Data point	Source
Breaches where credential abuse was the initial access vector	13% (22% in 2025)	Verizon DBIR 2026
Global average cost of a data breach	$4.99 million	IBM Cost of a Data Breach 2026
Passkey sign-in success rate vs passwords and traditional MFA	93% vs 78%	FIDO Passkey Index, October 2026
Share of successful sign-ins using a passkey (15 large consumer services)	36%	FIDO Passkey Index, October 2026

The gap between security policy and human behavior is where attackers live. The last two rows show that the replacement is no longer experimental.

Why MFA Is Not Enough

For years, the industry answer to password weakness has been to add factors on top: SMS codes, authenticator apps, push notifications. Multi-factor authentication (MFA) does sharply reduce the success of basic credential attacks.

But attackers adapted. Every MFA method that relies on a code or an approval a human can be tricked into handing over is now routinely bypassed.

SIM Swapping

An attacker calls a mobile carrier, impersonates the victim, and convinces a representative to move the victim's phone number to a new SIM card. Every SMS code now goes to the attacker. The FBI's Internet Crime Complaint Center recorded 2,026 SIM swap complaints with $72.6 million in losses in 2022, and 971 complaints with about $17.4 million in losses in its 2025 Internet Crime Report. Those are only the cases victims reported.

MFA Fatigue Attacks

The attacker already has the victim's username and password, often bought cheaply from a criminal marketplace. They trigger login attempts repeatedly, sending push notification after push notification to the victim's phone. Eventually the victim taps "Approve" just to make it stop. CISA calls this push bombing.

This is how Uber was breached in September 2022. According to Uber's own security update, an attacker obtained a contractor's password and the contractor eventually accepted one of the repeated MFA requests. The attacker then reached several internal tools, including Slack and the company's HackerOne dashboard.

Real-Time Phishing Proxies

Tools such as EvilProxy, Evilginx and Modlishka sit as transparent proxies between the victim and the real login page. The victim sees the legitimate site and enters their credentials and MFA code. The proxy captures everything in real time, including the session cookie. The attacker gets an authenticated session without needing the password or MFA code again.

The uncomfortable truth is that traditional MFA does not remove the underlying weakness of shared secrets. It adds friction for users while giving a shrinking margin of safety against modern attacks.

The Economics of Passwords

Security arguments sometimes fail to move budgets. The economic argument rarely does.

Password management is one of the largest hidden costs in enterprise IT. Every reset, lockout and helpdesk call has a dollar figure attached. The figures below are an illustrative model, not survey data. Replace each input with your own helpdesk numbers before you put it in a business case.

Input (illustrative)	Example value	How to get your real number
Fully loaded cost of one helpdesk password reset	$50	Helpdesk cost per ticket from your ITSM tool
Password resets per employee per year	4	Count reset tickets and self-service resets for 12 months
Productivity lost per reset	15 minutes	Time-stamp the ticket open and close events
Annual reset cost for a 5,000-person company	$1 million	5,000 x 4 x $50

That model leaves out the cost of the breaches passwords enable. IBM's 2026 Cost of a Data Breach report puts the global average at $4.99 million per breach, a record high.

There is also an opportunity cost that spreadsheets rarely capture. Engineers spend time on password policies, rotation logic, hashing and reset flows. Every hour spent on password infrastructure is an hour not spent on the product.

Real Breach Case Studies: When Passwords Became the Attack Vector

The arguments against passwords become concrete when you look at specific incidents where one compromised credential did enormous damage.

Colonial Pipeline (May 2021)

The largest fuel pipeline in the United States shut down for several days after the DarkSide ransomware group got in. Colonial's CEO told a US Senate committee that the attackers used a compromised password for a legacy VPN account that was not meant to be in use and had only single-factor authentication.

The result was fuel shortages across the southeastern United States and panic buying at gas stations. Colonial paid a ransom of about 75 bitcoin. The Justice Department later seized 63.7 bitcoin, then worth about $2.3 million, of that payment.

One password. One old account. Days of disruption to critical national infrastructure.

Uber (September 2022)

As described above, the attacker got in with a contractor's password and repeated MFA prompts. Every layer of that chain, the initial password and the approvable push, was a shared-secret problem that phishing-resistant credentials remove.

Okta (2022 and 2023)

Okta, an identity and access management company, has itself been hit through compromised access twice. In January 2022, the Lapsus$ group compromised a support engineer's computer at a third-party contractor. In October 2023, an attacker used a stolen credential to get into Okta's customer support system. Okta's follow-up disclosure and its November update confirmed that the attacker downloaded the names and email addresses of all its customer support system users.

The Pattern

In each case, the root cause was not a zero-day exploit or a novel technical vulnerability. It was a credential that a human created, reused, forgot to retire, or was tricked into handing over.

The Credential Stuffing Epidemic

Billions of stolen username and password pairs circulate in criminal marketplaces and public breach dumps. They are not theoretical risks. They are operational databases that power automated attacks at scale. You can check whether your own addresses appear in known breaches with the password breach check on this site.

Credential stuffing works because people reuse passwords. An attacker takes credentials leaked from one breach, say a gaming forum, and tests them against high-value targets such as banking portals, corporate VPNs and email providers. Even a fraction-of-a-percent success rate pays off at that volume.

Modern stuffing tools test credentials at high speed, spread attacks across thousands of IP addresses to dodge rate limits, and use residential proxy networks to mimic real traffic. Some solve CAPTCHAs automatically.

For an enterprise, every corporate password an employee reuses on a personal account creates a potential entry point. That account might be a streaming service, a food delivery app or a hobby forum. You have no visibility into, or control over, those services' security.

Password Manager Limitations

Password managers are often cited as the answer to password fatigue. They generate strong, unique passwords and store them behind a master password or, increasingly, a biometric. They are, without question, a big improvement over password reuse.

But password managers manage the problem. They do not solve it.

There is still a shared secret that travels over the network, can be captured by a phishing proxy, and is stored in hashed form on a server that can be breached. The manager makes the secret strong and unique. It cannot stop the secret from being captured in transit or stolen at rest.

Adoption is also uneven. In my experience, many employees still rely on browser autofill, spreadsheets, sticky notes or memory for work accounts, even where a company manager is available.

The Human Factor

Every password policy ever written is an attempt to override human nature with rules. Human nature usually wins.

When forced to create a "complex" password with uppercase, lowercase, numbers and symbols, most people follow predictable patterns. They capitalize the first letter, add a number at the end, and swap "a" for "@". The result looks complex to a policy checker but is easy for cracking tools that model these patterns.

When forced to rotate passwords every 90 days, most people increment a number (Summer2025 becomes Summer2026) or cycle through a few variations. NIST recognized this years ago. Its current guidelines, SP 800-63B-4, tell verifiers not to require periodic password changes unless there is evidence of compromise. Many organizations still have not adopted that advice.

The social engineering side is just as concerning. Humans are cooperative by nature. When someone who sounds authoritative calls and asks for help, the instinct is to help. Pretexting attacks exploit that instinct to extract credentials directly, bypassing every technical control.

Password-Based Attacks: A Taxonomy

Laying out the full range of password attacks makes the case for elimination clearer:

Attack Type	Method	Bypasses traditional MFA?	Password manager helps?
Phishing	Fake login page captures credentials	Yes (with proxy tools)	Partially (URL matching)
Credential stuffing	Automated testing of leaked credentials	No (if MFA is enforced)	Yes (unique passwords)
Brute force	Exhaustive guessing of passwords	No	Yes (long random passwords)
Password spraying	Testing common passwords across many accounts	No	Yes
Keylogging	Malware captures keystrokes	Yes (captures MFA codes too)	Partially (autofill avoids keystrokes)
Shoulder surfing	Watching password entry	Yes (if the MFA code is also seen)	Partially
Social engineering	Manipulation to reveal credentials	Yes (user may reveal the MFA code)	No
MFA fatigue	Repeated push notifications until approved	Yes (by design)	No
SIM swapping	Hijacking a phone number for SMS codes	Yes (by design)	No
Real-time phishing proxy	Transparent proxy captures session tokens	Yes (by design)	No

Look at the third column. Most of these attacks can get past traditional MFA. The fourth column shows that even the best password management covers only part of the threat landscape.

No amount of layering, policy or training removes the underlying risk of shared secrets. The only way to eliminate password attacks is to eliminate the password.

What Passwordless Actually Means

Passwordless authentication does not mean "no authentication." It does not mean weaker security or fewer checks. It means replacing knowledge-based secrets (things you know, type and can have stolen) with cryptographic proof tied to something you have and something you are.

In a passwordless model there is no shared secret between the user and the server. Instead of storing a hash of your password, the server stores a public key. The matching private key never leaves your device, or your synced credential store. You sign in by proving you hold the private key, through a cryptographic challenge usually unlocked by a fingerprint, face scan or device PIN.

This model removes entire categories of attack:

• Phishing: there is no secret to capture. Even on a fake site, the authenticator will not answer a challenge from the wrong origin.
• Credential stuffing: there are no credentials to stuff. A public key is useless without the private key.
• Server-side breaches: stealing a public key from a server is like stealing a padlock. You still cannot open it without the key.
• Replay attacks: each sign-in answers a unique challenge, so a captured response cannot be reused.

The FIDO Alliance and the WebAuthn Standard

Public-key authentication is not new. What is new is that the industry has agreed on a standard that makes it practical at scale.

The FIDO (Fast Identity Online) Alliance formed in 2012 to replace passwords through industry-wide standards. Its early standards, UAF and U2F, found a niche, especially in hardware security keys such as YubiKeys, but did not reach the mainstream.

The breakthrough was FIDO2, a joint effort of the FIDO Alliance and the W3C. FIDO2 has two parts:

1. WebAuthn (Web Authentication API): a W3C standard that lets web applications use public-key credentials for sign-in, supported natively by all major browsers.
2. CTAP (Client to Authenticator Protocol): the protocol that lets external authenticators, such as security keys and phones, talk to browsers and operating systems.

Together, they let any website or app offer passwordless sign-in with built-in authenticators (fingerprint readers, face recognition) or external hardware keys. No plugins, no downloads and no proprietary SDKs are needed.

The final piece arrived in May 2022, when Apple, Google and Microsoft jointly committed to passkeys: FIDO credentials that can sync across a user's devices. That removed the last big usability barrier, which was what happens when you get a new device.

The timeline of industry convergence:

Year	Milestone
2012	FIDO Alliance founded
2014	FIDO UAF and U2F specifications published
2019	WebAuthn becomes an official W3C Recommendation
2022	Apple, Google and Microsoft commit to passkeys; iOS 16 ships them
2023	Google makes passkeys the default option for personal Google Accounts
2025	NIST SP 800-63B-4 allows synced passkeys at AAL2
2026	FIDO's Passkey Index finds 36% of sign-ins at participating services use a passkey; Microsoft Entra ID makes passkeys the default for SMS and voice users

This is not a startup's pitch deck. It is coordinated action by the three largest platform companies, backed by a W3C standard, with native support in every major browser and operating system. The infrastructure is ready.

The Road Ahead

The case against passwords is not theoretical. It is empirical, economic and urgent. Passwords are a leading way attackers get in, an expensive authentication method to maintain, and the most frustrating part of many employees' day.

The technology to replace them exists today, is standardized, and is supported by every major platform. The question is no longer "should we move to passwordless?" but "how do we get there without disrupting operations?"

That is what the rest of this book covers. The next chapter goes deep into passkey architecture: how the cryptography works, what the deployment options look like, and what published deployment data shows.

The password had a good run. But its time is up, and its replacement is not just better. It closes the door on entire categories of attack that have plagued the industry for decades.

The enterprises that move first gain a security advantage, a cost advantage and a user experience advantage. The ones that wait keep paying the password tax: in helpdesk costs, in breach remediation, and in lost minutes every time someone stares at a login screen wondering which password it was.