One in 10 IT Decision Makers Have Implemented Passwordless Tech Across Their Entire Company

Bitwarden, the open source password manager for businesses and individuals, has announced the results of its 2023 Password Decisions Survey. The survey, which polled 800 IT decision makers across a wide range of industries, shows that passwordless technology is here to stay, with businesses enthusiastic about its perceived security benefits and improved user experience (UX).

According to the survey, roughly half of respondents deploy or have plans to deploy passwordless technology. Of that percentage, 66 per cent have 1-2 user groups or multiple teams using passwordless technology and 13 per cent have deployed to their entire organisation.

Desire remains for c-suite-driven security protocols

Businesses are confronting numerous post-pandemic security challenges: increased employee turnover, a hybrid workforce relying on multiple devices in many different locations, and a seemingly unending threat from cyber-criminals.

In light of these challenges, over three-fourths (79 per cent) of IT decision makers want employees to use the same enterprise-wide password manager. 60 per cent cite security as the most important attribute of a good password manager, followed by the integration of 2FA (56 per cent) and ease-of-use (40 per cent).

With hybrid and remote work here to stay for many employees, the lines between security habits at work and at home have blurred. The majority (71 per cent) of employees are ‘very likely’ to use a password manager with a complementary family account to give their family added security at home, if this was offered by their company.

Security concerns influencing business decisions

Sixty-percent of respondents report their organisation has experienced a cyberattack, up from 54 per cent last year. In response, a large majority (80 per cent) now have a ransomware mitigation strategy in place, an increase from 75 per cent last year. Cyber insurance is also becoming commonplace, with three-fourths (75 per cent) having the insurance.

Of the percentage that do, 65 per cent were required to show they offer cyber awareness training for employees, 64 per cent that they deploy MFA, and 61 per cent that they offer a company-wide password manager.

Bad habits coexist alongside best practices

Almost all respondents (92 per cent) use 2FA in the workplace, up from 88 per cent last year. However, nearly that same percentage also reuse passwords (90 per cent). While most (84 per cent) use password managers, they also manage passwords with documents on their computer (54 per cent) or with their memory (45 per cent).

Respondents also continue to rely on insecure methods to share passwords, such as shared online documents (38 per cent) and email (41 per cent). And despite their security-centric role, 32 per cent admit to engaging in ‘shadow IT’ practices and around half (49 per cent) of respondents say their organisation has struggled with employee shadow IT practices.

Further insights about passwordless technology

When asked why their organisation has not made the transition to passwordless technology, 39 per cent of respondents claim end users are reluctant to make the switch and 49 per cent say the applications they’re using are not designed to go passwordless. Of those that have made the switch, 51 per cent are or would consider implementing ‘something you are’ (facial, fingerprint, voice) passwordless authentication.

Half (47 per cent) say they are very familiar with the FIDO2 passwordless authentication standard and consider it important to their company’s passwordless experience.

“Our survey shows businesses are looking beyond passwords and desire new technologies that reflect passwordless workflows, which shouldn’t come as a surprise,” said Bitwarden CEO Michael Crandell. “While strong and unique passwords are highly effective at safeguarding data, weak or re-used passwords that are not managed by an end-to-end encrypted password manager present serious vulnerabilities.

“The Bitwarden approach takes into account this evolution but also reflects that adoption timelines vary by company, technology, and end-user preference and that security remains the paramount goal for individuals and enterprises alike.”