Companies Prioritize Passwordless Authentication for Employees

It’s no secret that passwords are a pain point for everyone from individual users to Chief Information Security Officers (CISOs). For CISOs, the persistent threat of compromised credentials due to weak password hygiene – employees leaving passwords exposed or resorting to easily guessable options – is a constant worry. For employees, the burden of remembering and managing multiple, complex passwords creates friction and reduces productivity.

Passwordless authentication technology, designed to circumvent these challenges, is gaining significant traction. According to a recent Wakefield Research survey commissioned by security vendor Portnox, a compelling 92% of surveyed CISOs indicated their organizations had already implemented or were planning to implement passwordless authentication solutions. This represents a marked increase from 70% in 2024, signaling a rapid shift in security priorities. CISOs are primarily driven by the promise of improved employee productivity and a streamlined user experience.

Passwordless authentication replaces traditional password-based verification with methods like hardware tokens, biometric scans (fingerprint, facial recognition), or mobile push notifications. Beyond enhanced security, these methods aim to create a more seamless and user-friendly experience.

Universal Technical Institute (UTI), a leading training services provider, has already begun leveraging Microsoft’s passwordless platform. “As we expand adoption, the benefits are immediately apparent. We’re seeing fewer password resets, a reduction in service desk tickets, and a faster, more efficient start to the workday for our employees,” says Adrienne DeTray, Senior Vice President and CIO at UTI.

DeTray highlights the cultural impact: “It signals our commitment to making technology feel less burdensome and more human. The proliferation of systems and logins over the years has added significant administrative overhead. Passwordless authentication is a critical step towards removing that friction and creating a more connected and streamlined ecosystem.”

The focus extends beyond security, encompassing user experience. “Every password reset or lockout introduces delays and disrupts workflow,” DeTray explains. “Passwordless authentication removes that daily friction, freeing up time and enabling a more productive work environment. It’s about designing an ecosystem where security and usability are intrinsically linked.”

MFA’s Evolving Role in Cybersecurity

R Systems International, a global provider of digital product engineering services, is currently executing a phased migration to a passwordless environment. “This isn’t about chasing a buzzword,” states CTO Srikara Rao. “It’s a direct response to the fact that our previous ‘gold standard,’ multi-factor authentication (MFA), is increasingly vulnerable. The threat landscape has evolved beyond the capabilities of traditional MFA.”

R Systems’ decision is fueled by both security imperatives and strategic business considerations. “Credential-based attacks remain the dominant threat vector. We’ve witnessed a significant surge in phishing attempts, with several near-miss incidents underscoring the urgent need for a more robust defense,” Rao explains. “We want to deploy solutions that are demonstrably resistant to phishing attacks.”

Operationally, password resets were proving to be increasingly costly. These costs stem from both direct labor expenses and indirect costs, such as lost employee productivity and IT resource strain. Forrester Research estimates that a single password reset can cost a company around $70, a figure that rapidly escalates for large enterprises.

Furthermore, adherence to increasingly strict compliance requirements, such as PCI 4.0, which mandates re-authentication upon system restart or access, necessitates a more seamless solution. “Passwordless authentication makes compliance significantly easier,” Rao states. “Finally, as we aggressively compete for top-tier tech and cybersecurity talent, being a passwordless enterprise sends a clear signal that we are a forward-thinking, security-first organization.”

BYOD Policies as a Catalyst

Diversus Health, a provider of health-care services, is also transitioning to passwordless authentication, specifically utilizing certificate-based network access control.

“The recent adoption of a bring-your-own-device (BYOD) policy triggered closer scrutiny during our internal annual HIPAA compliance audit,” explains Neil Ford, IT Security Administrator. “The audit identified a lack of network access control as a high-risk threat. We immediately began exploring solutions to mitigate this vulnerability.”

Earlier this year, Diversus Health deployed a system from Portnox that leverages certificate-based authentication to verify device identity. “We deploy the certificate through a cloud-based endpoint management solution, so verification with Portnox is transparent to our staff,” Ford clarifies.

This solution has effectively addressed the threat of unauthorized devices connecting to the company’s network and accessing internal resources. The technological underpinnings often involve Public Key Infrastructure (PKI), where each device receives a unique digital certificate that acts as its “identity card” within the network.

A critical component of a successful passwordless authentication adoption is clear and effective communication with employees. “Employees are overcoming decades of ingrained password habits, and addressing legitimate anxieties about device loss is paramount,” Rao emphasizes. “We quickly realized the importance of communicating the ‘why’ behind the changes.”

It’s essential to frame passwordless authentication not merely as another security mandate, but as a direct benefit to employees, highlighting reduced frustration, faster logins, and the elimination of password resets. Prior to deployment, R Systems conducted small, interactive training sessions to familiarize employees with access tools, such as fingerprint identification on their smartphones.

“I cannot overstate the crucial importance of comprehensive user education,” Rao stresses. “It is the critical differentiator between a successful deployment and an underutilized investment.”

R Systems’ passwordless strategy is not confined to a single vendor but is built on open standards like FIDO2 and WebAuthn. “This gives us the flexibility to choose the right tool for the specific risk profile,” Rao explains. “Privileged users, such as administrators, developers, and executives, utilize FIDO2 hardware security keys, while the broader workforce relies on passkeys (biometric credentials) integrated with device biometrics like Windows Hello and Face ID.”

Continuous evaluation and refinement are crucial to ensure optimal performance and user satisfaction.

“We’ve observed a dramatic improvement in employee experience, characterized by faster logins and a significant reduction in password-related help desk tickets,” Rao concludes. “Most importantly, passwordless authentication has become a cornerstone of our zero-trust architecture, providing a stronger, high-assurance identity layer that enables secure access regardless of user or device location.”