Frontline Workers Bypass MFA, Exposing Organizations to Risk
A survey reveals 95% of IT decision-makers have witnessed frontline workers using workarounds to bypass multi-factor authentication, increasing security vulnerabilities.
A significant majority of IT and security leaders have observed frontline workers in critical sectors like healthcare and manufacturing employing tactics to circumvent multi-factor authentication (MFA) and other security protocols. A recent survey by Sapio Research, which polled 700 IT and security decision-makers across the US, UK, France, and Germany, found that 95% have witnessed such workarounds in the past year. These practices, including leaving sessions open on shared devices and sharing credentials, fundamentally weaken the link between user accounts and individual employees, creating substantial security risks.
The primary driver for these workarounds appears to be the friction and time lost during authentication processes. On average, IT leaders estimate that 37% of their frontline workers encounter authentication issues each month, with each affected employee losing approximately 2.5 hours due to these problems. Common challenges cited by respondents include difficulties logging in while wearing gloves or protective equipment, delays when switching between devices or users on shared workstations, and issues with password resets, connectivity failures, and repeated MFA prompts. The data suggests no single solution will resolve all these authentication hurdles.
Beyond internal workarounds, attackers are actively targeting the account recovery and reset processes. The survey indicated that 62% of organizations have experienced a confirmed or suspected attempt to abuse account recovery, password reset, or unlock procedures within the last year. For 28% of these organizations, these attempts were confirmed, highlighting a prevalent attack vector where adversaries aim to gain control of accounts by impersonating legitimate users during identity verification steps.
Organizations employ various methods to verify identity during recovery, including employee badges, email, SMS codes, biometrics, and manager approval. However, none of these methods are universally adopted, and many are susceptible to compromise. Notably, 48% of IT decision-makers expressed significant concern about AI-enabled impersonation, mirroring their worries about traditional social engineering tactics. Help desks relying on easily hijackable channels like email or text messages for verification are particularly vulnerable.
The adoption of passwordless authentication methods, such as passkeys, is growing, with 28% of surveyed organizations utilizing them. However, a significant portion (45%) of these organizations still maintain passwords alongside passkeys, leaving an open avenue for attackers. Similarly, other passwordless methods like SMS codes, authenticator apps, and push approvals, while removing the typed password, remain susceptible to phishing attacks.
Organizations in transition, managing a mix of password and passwordless systems, report higher rates of credential sharing—twice as high as those fully embracing passwordless logins. This complexity can force workers to navigate multiple authentication systems, exacerbating the problem. The FIDO Alliance noted that organizations using passkeys report productivity gains and are planning further adoption, suggesting a path toward more secure and efficient authentication.
Despite advancements in authentication, the human element remains a critical vulnerability. Even with stronger credentials in place, 60% of respondents reported that their service desk faced confirmed or suspected social-engineering attempts in the past year. This underscores the ongoing need for comprehensive security awareness training alongside technological solutions to address the persistent threat of users being tricked into compromising their accounts or credentials.