2026 Identity Security Report Reveals Confidence Gap in Financial Organizations

• •82% of IAM leaders in financial services trust their authentication controls despite rising phishing.
• •Only 28% of MFA methods used are phishing-resistant, exposing organizations to account takeover risks.
• •Only 15% of authentication flows are passwordless, with significant barriers to implementing stronger security.

Secret Double Octopus released its 2026 State of Identity Security report, surveying 200 IAM leaders in financial services across the US and Canada. The report highlights a significant confidence gap, with 82% of respondents trusting their authentication controls despite a 94% increase in phishing attacks. Only 28% of their multi-factor authentication (MFA) methods are phishing-resistant, raising concerns about account takeover risks. MFA coverage is fragmented, with 74% for SaaS applications but only 50% for legacy systems. Additionally, only 15% of authentication flows are truly passwordless, and many methods still rely on hidden passwords. The report identifies technical complexity, cost, and legacy system support as major obstacles to implementing phishing-resistant MFA. The findings suggest that financial organizations may be underestimating their vulnerabilities.