Security Pros Still Use Passwords: The First-Day Default May Be the Problem

A Yubico–Okta survey of 1,890 technology and security professionals found that 43% still rely on passwords at work and 52% say they inherited passwords on day one. The finding does not prove onboarding caused every weak habit—but it points to a design problem: security advice cannot undo a risky default that the workplace itself hands to a new employee.

On a first day, people are trying to learn a new role, meet colleagues, find the right chat channel, and get access to the tools they need. A message that says “here is your password” or “IT needs you to approve this now” arrives at a moment when the employee has little context for what is normal. That is why account setup is not only an IT task. It is one of the first trust decisions an organization asks a person to make.

The new survey is about a gap, not a new kind of attack

Yubico and Okta published their 2026 Global State of Authentication survey on October 7. Talker Research surveyed 1,890 technology and security professionals at enterprises with 500 or more employees between July 2 and July 16, across nine markets. The respondents worked in cybersecurity, IT, product management, software engineering, and hardware engineering. That scope is important: the results describe a specific professional sample, not the general public or all organizations.

Among the findings, 43% said they rely on passwords at work. Fifty-two percent said they inherited passwords on their first day. The same release reports that 31% of participants considered hardware passkeys the most secure option, 27% preferred synced passkeys, and 23% chose device-bound passkeys through a mobile device. The organization that sells authentication products has a commercial interest in this topic, so readers should treat the press release as a source for what its survey says—not as independent proof that a particular device or service is right for everyone.

The compelling point is not “security staff do not know better.” The survey suggests the opposite: many respondents recognize stronger methods, yet daily work still runs through passwords. That is a gap between policy language and the experience someone actually receives. A first-day default can become a habit, especially when it is the fastest way to start a shift and nobody explains how to replace it safely.

Why day one is a social-engineering pressure point

A new starter does not yet know the organization’s unwritten rules. They may not know whether IT sends setup links by email, whether a manager can request an MFA reset, which help desk is real, or whether account recovery is handled through an internal portal. An attacker can exploit that information gap by borrowing authority: “I’m with support,” “your manager asked me to help,” or “you’ll lose access if you don’t do this now.”

Even without an attacker, an awkward process can teach the wrong lesson. If a colleague sends a password in an ordinary chat because that is the fastest route, the employee sees that credentials are conversational objects. If a manager asks for a verification code to “check that setup worked,” the employee may learn that sharing a code is part of onboarding. The danger is not that every coworker is malicious; it is that the pattern gives a future impersonator a believable script.

Reddit discussions among system administrators show how varied the first-login handoff can be. In one July thread, IT staff compared one-time setup links, temporary access passes, in-person walkthroughs, password-reset-at-first-login flows, and credentials sent to a personal email. Those comments are practitioner anecdotes, not a measure of how common each method is. But they surface the operational tension that ordinary employees feel: the company needs the new person productive, while the help desk needs a way to establish identity without handing reusable secrets to the wrong person.

This uncertainty is where the social engineering often lives. An employee sees a familiar company logo, a plausible support signature, and a request that resembles a real setup step. They are not evaluating it in a vacuum; they are trying not to delay their team. Good onboarding removes that pressure by making the trusted path obvious before a surprise message arrives.

Passwords are not the whole story—and passkeys are not magic

A unique, well-managed password is safer than a reused one, but a password can still be typed into a convincing fake page or disclosed to someone posing as support. A password manager can help people avoid reusing secrets and may refuse to autofill on a lookalike domain, but it cannot decide whether a legitimate-looking request in a work chat is authorized. Multi-factor authentication adds another check, yet not every method resists phishing in the same way.

CISA recommends that organizations move toward phishing-resistant MFA. Its guidance explains that FIDO/WebAuthn authentication is designed to bind the sign-in to the legitimate website, which can prevent a user from completing authentication on a fake lookalike page. That reduces an important class of credential phishing; it does not stop every social-engineering tactic. A person can still be manipulated into granting app permissions, approving a device enrollment, transferring money, or acting on a fraudulent instruction through a separate channel.

Passkeys also depend on the account, device, recovery design, and organization’s support process. A passkey can make a fake login page less useful to an attacker, but a confused employee still needs to know which setup screen is official and how to recover access if a device is lost. The safest message is not “adopt this one product and the human risk disappears.” It is “build a first-login path that is hard to impersonate and easy to follow.”

The same nuance applies to AI. The survey release says 44% of respondents reported an AI-driven attack in the prior year and 39% failed to distinguish AI-generated text from human writing. Those numbers are self-reported and depend on how each person interpreted “AI-driven.” The lesson is still practical: spelling, tone, and a polished signature are not reliable identity checks. Verify the request using a second channel that you choose yourself.

A safer first-login experience, in plain language

For the organization, the goal is to make that advice usable. A process can be technically strong and still fail if the new starter cannot find it, if the account is not ready when the person arrives, or if a manager must improvise a credential handoff. A thoughtful onboarding flow should answer basic questions before the first login: what channel will contact the new hire, how identity is confirmed, what the new employee must never share, and where to get help if the expected screen is missing.

Use an individual, time-limited setup route

Where the identity provider supports it, use a unique enrollment or temporary access mechanism that expires or is restricted to the intended first-login task. Do not create a shared starter password that every manager or help-desk worker knows. If a temporary secret is unavoidable, deliver it through the organization’s approved secure channel and require the employee to establish their own credentials before normal access begins. A reusable secret sent to a personal email account can become a long-lived weakness if nobody confirms that the recipient was the right person.

Enroll the stronger method while help is available

Do not leave MFA enrollment as an optional “later” step if the account can access email, cloud files, payroll, or customer data. Give the employee a clear explanation of which methods are supported, how to verify the official prompt, and what recovery route to use if a phone or security key is lost. For work accounts, follow the organization’s policy rather than adding personal methods without approval.

Make support easy to verify

Publish a directory entry, help-desk number, and portal address that the employee can find without using a link in an unexpected message. Tell employees that IT will not ask them to read out a password or one-time sign-in code. A manager should not be able to turn that rule off by claiming an emergency. If a reset is needed, let the employee initiate it through the known service or use a controlled identity-verification process.

Rehearse one realistic interruption

A short scenario can be more useful than another long lecture: “You are setting up email and someone in chat says they are support, asks for the code on your phone, and says your manager approved it. What do you do?” The expected answer should be simple—do not share the code; verify through the known help desk. Employees should be praised for slowing down, not blamed for asking a question.

How to respond if the setup request feels off

1. Stop the transaction, not your whole job. Leave the suspicious screen or pause the conversation. You do not need to keep replying while you investigate.
2. Do not share a credential or code. A one-time code, temporary password, recovery code, or device approval can grant access. “Support needs it” is not an identity check.
3. Open the official route yourself. Use a known bookmark, the company portal you were given during hiring, or the contact in the staff directory. Avoid the link or phone number in the unexpected message.
4. Ask your manager or help desk through a separate channel. If you are new and do not know the channel, ask HR or the person who gave you the official onboarding materials.
5. Report what happened, even if you are unsure. Share the sender, time, requested action, and whether you clicked, entered a password, or approved a sign-in. A quick factual report helps IT assess risk.

If you entered a password into a page that may be fake, use a separate trusted device or the employer’s official support route to report it and follow the organization’s reset process. Do not try to “fix” a work-managed account by changing recovery settings or installing security tools on your own. If you approved a sign-in you did not start, say so plainly; the organization may need to review sessions and access records.

What the survey can and cannot tell us

The Yubico–Okta release is useful as a snapshot of how security and technology professionals describe their own practices. It is not an independent audit of the respondents’ accounts, does not establish that inherited passwords caused the reported incidents, and does not show which organizations had a stronger or weaker outcome. The vendor relationship matters because Yubico sells authentication products and Okta sells identity services. Their commercial interest does not automatically make the numbers false, but it is a reason to read the sample and wording carefully.

There is also a difference between “uses a password” and “has only a password.” A worker may use a password alongside MFA, a managed device, conditional access, or other controls. The press release’s topline does not tell us how each person’s account is protected, how long the password is, whether it is unique, or how frequently it is used. That is why the article’s headline is not “43% of security pros are hacked.” It is that the first-day setup and the daily default deserve closer attention.

Likewise, the 52% figure should not be read as a verdict on the employees who inherited a password. People generally use the login method their employer issues and supports. If an organization wants a different behavior, it needs to change the process, not merely remind workers to be more careful after the process has already trained them otherwise.

The wider lesson: make the safe action the ordinary action

Security training is most effective when the workplace’s normal flow agrees with it. An employee cannot reliably reject suspicious requests if the real support team regularly asks for the same thing. A passwordless login is not meaningful if recovery depends on a manager sharing a secret. A phishing-resistant method does not help if people cannot find the enrollment instructions or if a rushed exception bypasses it.

The best first-day experience makes three things visible: the official route, the actions support will never request, and the recovery path when something does not work. That reduces the attacker’s ability to borrow a manager’s authority or exploit the employee’s fear of holding up their team. It also gives IT fewer one-off exceptions to patch later.

The new survey does not prove that the first morning is the source of every organizational security problem. It does point to an actionable question for employers: what credentials and authentication habits do people inherit on day one, and do those defaults match the behavior the organization expects them to follow? For employees, one simple rule travels well between jobs: a legitimate help desk can help you sign in, but it should not need you to disclose the secret that proves you are you.

Sources and further reading

• Yubico and Okta, October 7, 2026: 2026 Global State of Authentication findings — survey fielded July 2–16, 2026 among 1,890 enterprise technology and security professionals across nine markets.
• CISA: Implementing Phishing-Resistant MFA — official guidance on different authentication methods and phishing resistance.
• CISA: More Than a Password — FIDO/WebAuthn and phishing-resistant authentication guidance.
• Reddit, r/sysadmin: How practitioners deliver first-day access — anecdotal discussion of temporary credentials, enrollment links, and first-login workflows.
• Reddit, r/sysadmin: Remote employee onboarding and account setup — practitioner discussion, not a representative survey.
• Related guide: Verify an unexpected security alert through a channel you choose.