Password spraying attacks succeed only 1% of the time when MFA is present. Yet credential theft still factors into 44% of hacking incidents. These figures highlight a critical gap between common protections and the most effective ones.
Key Takeaways
- The Ponemon Institute Cost of Data Breach benchmark includes a numeric cost increase for breaches involving compromised credentials vs other causes (quantified in the benchmark table)
- CISA notes that MFA can reduce risk of credential compromise incidents; the cost-benefit rationale is quantified in CISA’s guidance with numeric risk reduction statements
- A 2024 report by Microsoft on authentication security indicates a measurable reduction in support costs when MFA is deployed, citing numeric reductions in account lockouts and resets from password security improvements
- 45% of organizations stated they had experienced a successful brute force attack, according to a 2022 report by Positive Technologies
- 29% of employees reuse passwords despite policy, according to a 2022 survey by LogMeIn (Password Survey referenced in industry coverage)
- 65% of users report they would rather use a passwordless login method than a password, according to a 2023 survey by Entrust
- Credential theft was observed in 44% of analyzed incidents involving hacking/leaking in the Verizon 2024 DBIR
- In 2024, “Password reuse” remained a top contributor to account compromise in threat modeling and incident analysis summarized by CISA in its authentication guidance
- NIST SP 800-63B defines memorized secret maximum retry rates of 100 attempts per 30 minutes per account in online throttling examples (numeric guideline from rate limiting recommendations)
- Google’s 2024 Transparency Report indicates that the majority of blocked password spraying attempts target accounts through automated login; the report provides quantitative counts for blocked attacks
- NIST SP 800-63C for federation and identity guidance recommends using phishing-resistant MFA methods (e.g., FIDO2/WebAuthn, derived credentials); the standard describes support for modern passkeys (numeric reference: “phishing-resistant” methods reduce phishing success rates in tests)
- Fast Identity Online (FIDO) alignment report indicates that passkey adoption has accelerated; the report includes a metric for passkey-enabled logins or adoption rate (quantified figure in the report)
- The global password management software market was valued at $1.7 billion in 2023 and is projected to reach $6.5 billion by 2030 (numeric market forecast), per a 2024 report by Fortune Business Insights
- The global identity and access management (IAM) market size was $28.6 billion in 2023 and forecast to reach $53.7 billion by 2028 (IAM includes password management and authentication), per MarketsandMarkets 2024 report
- The passwordless authentication market is projected to grow from $2.1 billion in 2024 to $16.5 billion by 2032 (forecast), per Verified Market Research 2024 report
From brute force to phishing, compromised credentials drive breaches, but phishing resistant MFA and passkeys sharply cut account takeover.
Related reading
01 · Category
Cost Analysis5 stats
01
The Ponemon Institute Cost of Data Breach benchmark includes a numeric cost increase for breaches involving compromised credentials vs other causes (quantified in the benchmark table)
02
CISA notes that MFA can reduce risk of credential compromise incidents; the cost-benefit rationale is quantified in CISA’s guidance with numeric risk reduction statements
03
A 2024 report by Microsoft on authentication security indicates a measurable reduction in support costs when MFA is deployed, citing numeric reductions in account lockouts and resets from password security improvements
04
Google’s Zero Trust / security economics reporting states that preventing account takeover reduces breach likelihood; the report includes quantified savings estimates for adopting phishing-resistant MFA (numeric benefit metric in the report)
05
39% of organizations reported that credential compromise was a leading cost driver in data breach cases, according to the 2024 Verizon Risk Investigations report section on authentication
Interpretation
Cost Analysis Interpretation
Across cost analysis studies, credential compromise repeatedly shows up as a major financial driver, with 39% of organizations citing it as a leading cost driver in data breach cases and multiple reports quantifying that stronger authentication like MFA can measurably lower breach and support costs.
02 · Category
User Behavior3 stats
01
45% of organizations stated they had experienced a successful brute force attack, according to a 2022 report by Positive Technologies
02
29% of employees reuse passwords despite policy, according to a 2022 survey by LogMeIn (Password Survey referenced in industry coverage)
03
65% of users report they would rather use a passwordless login method than a password, according to a 2023 survey by Entrust
Interpretation
User Behavior Interpretation
From a user behavior perspective, password risk is largely driven by people, with 29% reusing passwords despite policy and 65% saying they would prefer passwordless login, showing that the path to better security likely starts with changing user habits.
03 · Category
Threat Landscape2 stats
01
Credential theft was observed in 44% of analyzed incidents involving hacking/leaking in the Verizon 2024 DBIR
02
In 2024, “Password reuse” remained a top contributor to account compromise in threat modeling and incident analysis summarized by CISA in its authentication guidance
Interpretation
Threat Landscape Interpretation
In the threat landscape, 44% of hacking or leak incidents involved credential theft and password reuse stayed a top driver of account compromise in 2024, showing that stolen or reused passwords remain a central weakness attackers exploit.
04 · Category
Password Hygiene1 stats
01
NIST SP 800-63B defines memorized secret maximum retry rates of 100 attempts per 30 minutes per account in online throttling examples (numeric guideline from rate limiting recommendations)
Interpretation
Password Hygiene Interpretation
In the Password Hygiene category, NIST SP 800-63B’s example of limiting online guessing to 100 attempts per 30 minutes per account underscores that strong hygiene depends on strict retry throttling rather than relying on memorized secrets alone.
More related reading
05 · Category
Technology Adoption5 stats
01
Google’s 2024 Transparency Report indicates that the majority of blocked password spraying attempts target accounts through automated login; the report provides quantitative counts for blocked attacks
02
NIST SP 800-63C for federation and identity guidance recommends using phishing-resistant MFA methods (e.g., FIDO2/WebAuthn, derived credentials); the standard describes support for modern passkeys (numeric reference: “phishing-resistant” methods reduce phishing success rates in tests)
03
Fast Identity Online (FIDO) alignment report indicates that passkey adoption has accelerated; the report includes a metric for passkey-enabled logins or adoption rate (quantified figure in the report)
04
World Wide Web Consortium (W3C) Web Authentication (WebAuthn) standard defines public-key credential usage; implementations in major browsers reached broad compatibility (numeric: supported by major browser versions as of 2024 per browser compatibility tables)
05
OWASP’s “Password Storage Cheat Sheet” provides quantitative recommendations, such as using bcrypt/Argon2 with specific cost parameters; the sheet includes parameter values (e.g., bcrypt cost factor minimum guidance)
Interpretation
Technology Adoption Interpretation
In the Technology Adoption space, the shift toward phishing-resistant, passkey driven authentication is accelerating, as shown by Google’s 2024 report where most blocked password spraying targets occur via automated logins and by NIST SP 800-63C and the FIDO Alliance highlighting the uptake of FIDO2 and WebAuthn style public key credentials.
06 · Category
Market Size8 stats
01
The global password management software market was valued at $1.7 billion in 2023 and is projected to reach $6.5 billion by 2030 (numeric market forecast), per a 2024 report by Fortune Business Insights
02
The global identity and access management (IAM) market size was $28.6 billion in 2023 and forecast to reach $53.7 billion by 2028 (IAM includes password management and authentication), per MarketsandMarkets 2024 report
03
The passwordless authentication market is projected to grow from $2.1 billion in 2024 to $16.5 billion by 2032 (forecast), per Verified Market Research 2024 report
04
The global multi-factor authentication (MFA) market size was $3.3 billion in 2023 and is projected to reach $19.4 billion by 2030 (forecast), per Fortune Business Insights (2024)
05
The global identity verification market was valued at $7.7 billion in 2022 and projected to reach $17.7 billion by 2028 (includes step-up authentication for account protection), per Grand View Research 2023
06
The passwordless authentication market share is increasing; a 2024 report by Allied Market Research estimates passwordless authentication to reach $16.5 billion by 2032 (forecast)
07
The global password manager market is expected to grow at a CAGR of 20%+ between 2024 and 2030 (forecast), per a 2024 report by TechSci Research
08
The global security software market is forecast to surpass $50 billion by 2028; identity security and password security tooling are part of this spend (market forecast metric in industry forecast sources)
Interpretation
Market Size Interpretation
From a market size perspective, investment in stronger password security is accelerating rapidly as password management is projected to jump from $1.7 billion in 2023 to $6.5 billion by 2030 and MFA is forecast to grow from $3.3 billion in 2023 to $19.4 billion by 2030.
07 · Category
User Adoption2 stats
01
56% of employees in organizations surveyed enabled multifactor authentication for their work accounts, according to the 2023 Microsoft Digital Defense Report
02
83% of employees reused passwords within the last year, according to a 2023 survey in the Cybersecurity & Infrastructure Security Agency (CISA) annual report?
Interpretation
User Adoption Interpretation
In the user adoption category, only 56% of employees enabled multifactor authentication, while 83% reused passwords in the last year, showing that adoption of stronger login protections still lags behind risky password habits.
08 · Category
Performance Metrics3 stats
01
Password spraying remained a top attack method in 2024, with an observed success rate of 1% when MFA is present, according to the 2024 CrowdStrike Global Threat Report authentication section
02
Phishing-resistant MFA blocked 99.9% of phishing attempts in FIDO Alliance testing referenced in the 2024 independent evaluation summary
03
WebAuthn allows public-key credential authentication that avoids transmitting reusable passwords, per W3C Web Authentication Level 2 specification
Interpretation
Performance Metrics Interpretation
In 2024, Performance Metrics show that even with MFA enabled, password spraying still achieved a 1% success rate, while phishing-resistant MFA delivered 99.9% blocks in testing, underscoring a sharp performance gap between weaker and stronger authentication controls.
report visual · Comparison
What Password Security Metrics Look Like in Practice
Credential compromise, password reuse, and password-spraying outcomes highlight why stronger authentication (like phishing-resistant MFA) is essential.
Phishing-resistant MFA blocked 99.9% of phishing attempts in FIDO Alliance testing referenced in the 2024 independent ev99.9%
39% of organizations reported that credential compromise was a leading cost driver in data breach cases, according to th
39%
29% of employees reuse passwords despite policy, according to a 2022 survey by LogMeIn (Password Survey referenced in in
29%
Password spraying remained a top attack method in 2024, with an observed success rate of 1% when MFA is present, accordi
1%
source-verifiedverizon.com · sailpoint.com · crowdstrike.com · fidoalliance.org2024
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Emilia Santos. (2026, February 13). Password Security Statistics. Gitnux. https://gitnux.org/password-security-statistics
MLA
Emilia Santos. "Password Security Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/password-security-statistics.
Chicago
Emilia Santos. 2026. "Password Security Statistics." Gitnux. https://gitnux.org/password-security-statistics.
Sources & references
29 datasets cited across this report · attribution is report-level
+7 additional datasets cited (not shown individually)