Australian Security Awareness Gap Leaves Nearly Half of Tech Staff Relying on Passwords

An Australian passkey security gap is leaving many enterprise workers dependent on passwords despite strong awareness of safer authentication methods, according to new research from Yubico and Okta, Inc.

The research found that 93% of Australian IT and security professionals know about passkeys. However, 61% received a basic username and password when they started their current role. Another 45% still use standard passwords as their primary way to authenticate to work accounts.

The findings come as AI-assisted phishing and impersonation create additional pressure on identity security. According to the research, 43% of Australian enterprise organisations suffered at least one successful AI-driven phishing attack during the past 12 months.

Another 47% of Australian technical staff reported deepfake impersonation attempts targeting colleagues. These included suspicious videos, phone calls or voice calls claiming to come from executives or clients.

The 2026 Global State of Authentication report was conducted by Talker Research. It surveyed nearly 2,000 technology and cybersecurity professionals across nine global markets, including Australia.

Australian passkey security gap persists despite high awareness

The report describes the difference between security knowledge and workplace practice as an “Awareness Gap.”

It found that 93% of Australian IT and security professionals are familiar with passkeys. In addition, 61% identified device-bound, hardware-backed passkeys as the single most secure authentication method available.

However, workplace authentication practices have not kept pace with that awareness.

Australia ranked lowest among the countries surveyed for issuing hardware security keys to new employees. Only 17% received them during onboarding. That compares with 29% in Germany and a global average of 24%.

Instead, 61% of Australian technical workers received a basic username and password when they started their current roles. Some 45% still use standard passwords as their primary authentication method for work accounts.

The report also found that 73% of Australian organisations use fragmented authentication across different applications. Meanwhile, 24% do not enforce multi-factor authentication (MFA) across all enterprise apps.

“Enterprise cybersecurity has a critical execution gap,” said Poupak Enbom, Chief Market and Growth Officer at Yubico. “Security leaders know hardware-backed passkeys – specifically hardware security keys – offer the highest level of protection, yet nearly half still rely on basic usernames and passwords daily. The gap isn’t expertise; it’s overcoming the friction to user adoption.”

AI phishing tests the limits of the “human firewall”

The research also examined whether technology and cybersecurity professionals could distinguish human-written messages from AI-generated content.

In a practical identification test, 57% of Australian technical professionals incorrectly identified a genuine, human-written HR email as AI-generated. Only 37% correctly identified it as human-written.

Meanwhile, 54% correctly identified an AI-generated email.

Globally, no professional or demographic group scored above 50% accuracy when identifying human text, according to the report.

The findings challenge the assumption that employees can reliably detect suspicious messages by looking for writing mistakes or other traditional phishing indicators.

Australians demand stronger oversight of AI agents

The report also examined attitudes toward autonomous AI software agents and the controls organisations should place around them.

Australia recorded the highest level of support for human approval among the markets surveyed.

Some 72% of Australian technical leaders said reviewing and giving final approval for AI agent actions is ‘very important’. The global average was 56%, while the figure for Japan was 32%.

Another 70% of Australian respondents said verifying an AI agent’s identity and authenticity is ‘very important’.

However, attitudes varied according to the decisions AI agents would make. Some 43% of Australian workers said they would trust an AI agent to execute low-risk operational micro-decisions.

In contrast, 20% said they would not trust an AI agent with any business decisions without a human-in-the-loop.

Yubico and Okta propose a three-stage authentication approach

Yubico and Okta argue that organisations should move toward phishing-resistant authentication before, during, and after authentication.

Before Authentication: Mandate device health and posture checks to verify endpoint compliance before establishing an access session. Issue phishing-resistant authenticators to new employees as part of the workforce onboarding process to support high-assurance MFA from the first login attempt.

During Authentication: Enforce the use of phishing-resistant authentication in application sign-on policies to consistently and automatically mitigate AI phishing attempts at sign-in.

After Authentication: Maintain continuous context and risk evaluation to detect session compromise. Require proof of human presence, either through a physical hardware interaction such as a key touch or biometric authentication, for human-in-the-loop authorization of autonomous AI workflows.

“Generative AI has effectively eliminated traditional phishing indicators like poor grammar and awkward phrasing, rendering human detection obsolete as a security boundary. Australian organisations are rightly demanding strict human-in-the-loop governance for AI agents, but they are leaving the metaphorical front door unlocked by relying on legacy passwords during onboarding.

“Security awareness training cannot fix an architectural flaw. To defend against AI-driven phishing and deepfakes, Australian business leaders must transition to phishing-resistant, hardware-backed authentication,” said Geoff Schomburgk, Vice President Asia Pacific & Japan at Yubico.

Key data point comparisons for Australia

Research Methodology

The 2026 Global State of Authentication report was conducted by Talker Research between July 2, 2026, and July 16, 2026. The quantitative survey polled 1,890 technology and security professionals in enterprise organizations (500+ employees) across nine markets: the United States, the United Kingdom, Australia, India, Japan, Singapore, France, Germany, and Sweden. Respondents held roles across Cybersecurity, IT, Product Management, Software Engineering, and Hardware Engineering.

For more information about Australia and video commentary from Geoff Schomburgk, watch the short video below.

About Yubico

Yubico (Nasdaq Stockholm: YUBICO) is a global cybersecurity pioneer dedicated to making the digital world safer for everyone. As the creator of the YubiKey, Yubico set the gold standard for phishing-resistant, hardware-backed authentication—virtually eliminating account takeovers while keeping secure login effortless.

A leader in authentication since 2007, Yubico co-created global standards like FIDO2, WebAuthn, and FIDO U2F, and introduced the foundational technology behind the modern passkey. Today, the company’s passkey solutions secure businesses, governments, and individuals in more than 160 countries, safeguarding the entire digital identity lifecycle from onboarding to recovery.

Trusted by the world’s most security-conscious brands, AI frontiers, and institutions, YubiKeys deliver fast, friction-free, passwordless access across hundreds of enterprise applications out of the box. True to its mission, Yubico also drives the Secure it Forward philanthropic initiative, donating YubiKeys to vulnerable communities and nonprofits globally.

Our global footprint includes headquarters in Stockholm, Sweden, Silicon Valley, California, and Singapore. Yubico is proud to be recognized as one of TIME’s 100 Most Influential Companies and Fast Company’s Most Innovative Companies. Learn more at www.yubico.com.