Frontline workers share credentials, breaking identity links and creating auth risks
Healthcare and manufacturing workers share credentials and leave sessions open, creating significant authentication risks for organisations.
Key points
- Ninety-five percent of surveyed IT leaders report frontline workers using MFA workarounds.
- Shared credentials and open sessions break the link between identity and account usage.
- Sixty-two percent of organisations faced attempts to abuse account recovery processes.
Sapio Research surveyed seven hundred IT and security decision-makers in August, finding that ninety-five percent had observed frontline workers bypassing multifactor authentication controls in the previous twelve months. These workers, primarily in healthcare and manufacturing sectors, circumvent slow or unreliable login processes by sharing credentials, leaving sessions active on shared workstations, and avoiding MFA prompts entirely.
Root cause
The primary driver is operational friction. Respondents estimated that thirty-seven percent of frontline staff encounter authentication problems each month, costing each affected worker approximately two and a half hours monthly. Challenges include logging in while wearing gloves, switching between devices, connectivity failures, and repeated MFA prompts. No single cause dominates; the top nine challenges are within six percentage points of each other, suggesting no simple technical fix exists.
Attack path
These habits sever the link between an account and the specific user. An open session on a shared device allows subsequent workers to act under another’s identity. Similarly, circulated passwords enable anyone with knowledge of them to access systems. Attackers exploit these weaknesses externally; sixty-two percent of respondents reported confirmed or suspected attempts to abuse account recovery, password resets, or unlocks in the past year.
Affected versions
The data applies to organisations with five hundred or more employees across the US, UK, France, and Germany. It specifically impacts frontline roles in healthcare and manufacturing where shared devices and protective equipment complicate standard authentication workflows. The findings reflect practices observed over the twelve months preceding the August survey.
Mitigation
- Review account recovery procedures to ensure they do not rely solely on easily spoofable channels like SMS or email.
- Implement adaptive authentication that reduces friction for low-risk actions while maintaining security for sensitive tasks.
- Audit shared workstation policies to ensure sessions expire automatically and credentials are not stored locally.
- Train staff on the security implications of sharing credentials and leaving sessions open on communal devices.
What it means for organisations
Teams usually need to reconcile security policy with operational reality. Check whether current authentication methods create unacceptable delays for frontline staff. Identify who inside the organisation needs to be told about these friction points, including operations managers and help desk supervisors. Evaluate if existing identity verification steps for account recovery can be easily bypassed by social engineering or AI-enabled impersonation.
Background: Social engineering
Isolate the affected device immediately to stop data exfiltration. Change all credentials from a clean device, not the compromised one. Notify your security team and preserve logs. Review access patterns for anomalies. Implement multi-factor authentication to prevent recurrence. Document every action for forensic analysis.
Read the full guide: Social Engineering Response: Containment and Recovery Steps
What to do and how to stay safe: Sapio Research
- Audit shared workstations for persistent sessions and implement automatic timeout policies.
- Review account recovery workflows to eliminate reliance on single-factor verification methods like SMS.
- Monitor for unusual login patterns that may indicate credential sharing or takeover attempts.
- Engage with frontline staff to identify specific authentication friction points and pilot alternative solutions.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many IT leaders reported seeing MFA workarounds?
Ninety-five percent of the seven hundred surveyed decision-makers reported seeing frontline workers use workarounds in the past year.
What are the most common reasons for authentication failures?
Top challenges include logging in with gloves, switching devices, connectivity issues, and repeated MFA prompts, with no single cause standing out.
How are attackers exploiting these vulnerabilities?
Attackers are targeting account recovery and password reset processes, with sixty-two percent of organisations reporting suspected or confirmed abuse attempts.
