Knowledge is not the same as deployment
An October 7 analysis from Okta of its joint authentication study with Yubico reports that 87% of surveyed technology and security professionals knew about passkeys, yet 43% still used passwords to sign into work. The study covered respondents across nine countries. These are survey responses from a defined professional sample, not a measurement of every employer’s authentication systems.
Onboarding and inconsistent systems
Okta reports that 52% of respondents received username-and-password credentials when they started their roles, while 76% described fragmented authentication methods across internal applications. The company argues that everyday friction and inherited defaults undermine stronger sign-in practices. The results support examining the rollout process; they do not, by themselves, prove that changing one onboarding step will produce a particular reduction in attacks.
Start with a real employee journey
For a small business or financial-services office, our assessment is that the most useful test begins with a new employee and the applications required on day one. Can the employee complete approved enrollment, use a second device if necessary and get help without being told to fall back to a shared credential? Document where that journey stops. The obstacle may be an older application, unclear support ownership or a policy exception nobody has revisited. Each calls for a different remedy; another awareness presentation will not resolve all three.
Measure use, recovery and exceptions
An MSP can make an authentication project more accountable by reporting actual coverage across the agreed application list, the remaining exceptions and the support process for a lost or replaced device. Test the recovery route with the customer before broad deployment, including the evidence help-desk staff require before changing access. Assign expiration or review dates to temporary exceptions so that the migration does not quietly stall. Management should be able to distinguish users who have enrolled a stronger credential from applications that still allow an older route. Those are different milestones, and treating them separately produces a clearer completion standard.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
