| Share

New Study by Yubico and 451 Research reveals nearly 75% of Enterprise Security and Risk Managers Plan to Increase Multi-Factor Authentication Spending



Despite increased spend, research shows gaps in MFA best practices with only 22% perceiving security of SMS-based authentication as an issue

Yubico, the leading provider of hardware authentication security keys, today announced the results of a new research study, Work-from-Home Policies Driving MFA Adoption, But Still Work to be Done, conducted in partnership with 451 Research across North America. The report analyses preferences and adoption trends with respect to multi-factor authentication (MFA) in the enterprise and ultimately reveals that while MFA adoption and spending is on the rise, organisations are still unclear on best practices and methodologies.

The findings show that MFA adoption and spending has increased within the enterprise due to a confluence of several factors: the growing recognition that stolen credentials and phishing attacks are at the root of most security breaches; the rise of work-from-home (WFH) policies due to the COVID-19 pandemic; and the adoption of modern authentication standards such as Fast Identity Online (FIDO) U2F, FIDO2 and WebAuthn that underpin new advances in two-factor (2FA) and passwordless authentication.

However, the research also highlights a variety of barriers to more widespread MFA usage such as inconvenience, complexity, and cost. Furthermore, many enterprises remain largely unaware of the security defects found within more common mobile MFA form factors such as SMS-based authentication, which has been widely deprecated for years.

“The pandemic and the move to cloud-based office applications has been a turning point for enterprises to implement and modernise their multi-factor authentication,” said Stina Ehrensvärd, CEO and Founder, Yubico. “What this research shows is that while there is an appetite for strong security with an elegant user experience, many companies stick with less effective old habits and technologies. A user deployment study by Google was the first to highlight the remarkable benefits and return on investment of YubiKeys and security keys. This new research is a great further validation of the authentication technology Yubico invented and the standards work we have spearheaded.”

Key findings from the survey include:

       MFA spending trends are encouraging with nearly three out of four respondents (74%) planning to increase spending on MFA. It was the top security technology to be adopted due to COVID-19 and the subsequent migration to WFH (49%). 

       Over half (53%) of all respondents have experienced a security incident or breach in the past year and MFA was among the top three security technologies adopted as a response to a security breach.

       Increased security is the number one reason enterprises are adopting MFA, with 57% of respondents reporting as much. User experience (43%), complexity (41%), and cost (36%) are still the main obstacles to MFA adoption, which comes as no surprise. These challenges have long been common complaints about MFA, even though modern authentication technologies such as biometrics and security keys have been proven to provide better security and usability than legacy MFA technologies. 

       Despite the increase in security vulnerabilities for mobile and SMS-based MFA, mobile OTP authenticators (58%), mobile push-based MFA (48%), and SMS-based MFA (41%) are among the most popular MFA form factors other than passwords. This reveals that enterprises may still perceive mobile MFA as being more user-friendly and accessible than other MFA options and are prioritising user experience over security benefits despite reporting otherwise. 

       Many organisations still rely heavily on SMS-based authentication, but only 22% perceive security of this form factor as an issue despite growing evidence of breaches and attacks exploiting mobile or SMS-based authentication methods.

       Enterprises are stopping at privileged users when it comes to usage of MFA but time and time again breaches are showing that lower-level employees can leave an organisation vulnerable by being a 'way in' for adversaries. The research shows that privileged users and third parties (contractors, consultants, partners) are the most likely to use MFA, while end customers are the least likely.

       FIDO2 and passwordless authentication are gaining momentum as ways to address traditional MFA pain points as more than half of the organisations surveyed (61%) have either deployed or have passwordless authentication in pilot (34% of respondents have already deployed passwordless technology, 27% in pilot).

About the Study

In November 2020, 451 Research conducted an online survey of organisations that have implemented two-factor or multi-factor authentication across North America. The survey targeted 200 executive management, senior IT management, mid-level management, senior security and risk staff, and senior risk staff in verticals such as technology, financial services, education, professional services, retail and the government sector. In addition, the survey captured data from respondents representing companies with 1-10,000+ full-time employees.

Download the complete report here, and for a deep dive into the findings from this report, sign up for the upcoming Yubico webinar, Remote Work During COVID-19 Drives MFA Adoption, on May 18 at 10 am PT.