DIGITAL

&

TRENDSPasswordsecurityintheU.S.CHAPTER

01OverviewInformationsecurityspendingworldwidefrom2017to2024,bysegment(inmillionU.S.dollars)Totalspendingonglobalinformationsecuritymarket2017-2024,bysegmentApplicationsecurityIdentityaccessmanagementSecurityservicesCloudsecurityInfrastructureprotectionConsumersecuritysoftwareDataprivacyIntegratedriskmanagementDatasecurityNetworksecurityequipment250,000200,000150,000100,00050,000020172018201920202021202220232024*3Description:Globalspendingoninformationsecurityhasbeengrowingfrom2017to2023,increasingfromjustunder100billionU.S.dollarsin2017toalmost200billionU.S.dollarsin2023.Mostspendinghasconcentratedinsecurityservices,infrastructureprotection,andnetworksecurityequipment.Spendingonsecurityservicesisexpectedtoreachnearly90billionU.S.dollarsby2024.ReadmoreNote(s):Worldwide;2017to2023;*ForecastReadmoreSource(s):GartnerWorldwidesecurityspendingintheidentityaccessmanagementsegmentfrom2017to2024(inbillionU.S.dollars)GlobalITsecurityspendinginidentityaccessmanagement2017-202420181618.5616.1715.8713.941412.04121089.779.848.82642020172018201920202021202220232024*4Description:Accordingtorecentdata,theworldwideidentityandaccessmanagement(IAM)marketgeneratedapproximately16.17billionU.S.dollarsinrevenueduring2023,asignificantincreasewhencomparedtothepreviousyear.ThismarketisthenforecasttogrowbyovertwobillionU.S.dollarsin2024,reachingaround18.5billionU.S.dollars.ReadmoreNote(s):Worldwide;2017to2023;*Forecast.ReadmoreSource(s):GartnerMarketvalueofIdentityandAccessManagement(IAM)in2022and2029(inbillionU.S.dollars)GlobalmarketvalueofIdentityandAccessManagement2022-202950454035302543.12015.815105020222029*5Description:TheglobalIdentityandAccessManagement(IAM)marketgeneratedrevenuesestimatedatnearly16billionU.S.dollarsin2022.ItisforecastedthatthemarketvalueofIAMwillincreaseto43.1billionU.S.dollarsby2029.IAMreferstoaframeworkofpolicies,businessprocesses,andtoolsusedtoregulateandfacilitatetheappropriateaccesstoacompany’sresources.

ReadmoreNote(s):Worldwide;2022;*Forecast.ReadmoreSource(s):GIIPasswordmanagementmarketrevenueworldwidefrom2020to2030(inbillionU.S.dollars)Globalpasswordmanagementmarketrevenue2020-20308765437.133.072.92.352.05211.2502020202220232025202720306Description:ThepasswordmanagementmarketwasvaluedatslightlyabovetwobillionU.S.dollarsin2022andwasexpectedtoexceedthreebillionU.S.dollarsinrevenueby2025.However,thepastfewyearshaveseentheemergenceofnewandmoresecureauthenticationmethodssuchaspasswordlesssecurityormulti-factorauthentication.Despitetheinstabilitythatpasswordsecuritycurrentlyhas,itremainsthemostusedsecuritymethodworldwidetograntaccesstocompanyinfrastructure.ReadmoreNote(s):Worldwide;2022Source(s):GlobeNewswirePasswordlessauthenticationmarketrevenueworldwidefrom2021to2030(inbillionU.S.dollars)Passwordlessauthenticationglobalmarketsize2021-203060504053.646.239.734.129.33025.221.618.52010015.612.820212022202320242025202620272028202920307Description:Passwordlessauthenticationisasecurityprocesswhichtypicallyreliesonsecuritytokens,personalidentificationnumbers,andanindividual'suniquebiologicalcharacteristicssuchas:fingerprintrecognition,irisrecognition,facerecognition,voiceanalysis,andmanyothers.Thisauthenticationmethodcomeswithouttheuseofpasswordsandhasseveraladvantages,suchasimproveduserexperienceandhighersecurity.AccordingtoNextMoveStrategyConsulting,thepasswordless[...]

ReadmoreNote(s):Worldwide;2021to2030Source(s):NextMoveStrategyConsultingNumberofindividualsimpactedbydataviolationincidentsintheUnitedStatesfrom2015to2023(inmillions)NumberofindividualsaffectedbydatacompromisesintheU.S.2015-20233,0002,541.12,5002,227.82,0001,825.41,5001,0005000883.62019422.142022353.022023318.32015310.12020293.920212016201720188Description:In2023,over353millionindividualswerevictimizedbycyberdataviolationssuchasbreaches,dataexposures,anddataleaksintheUnitedStates.Thisrepresentsadecreaseof16percentfrom2022.Despitethedecreasedthenumberofdataviolationincidentsfrom2021,thedetectedincidentsofdatacompromisesimpactedmoreindividualsinrecentyears.ReadmoreNote(s):UnitedStates;2015to2023;victimsofdatabreachesthatoccurintheUnitedStatesmaynotbelocatedintheU.S.themselvesSource(s):IdentityTheftResourceCenterLeadingauthenticationprioritiesworldwidein2023Topauthenticationprioritiesworldwide202345%41%40%35%30%25%20%15%10%5%33%12%12%2%0%Increasetwo-factorauthenticationadoptionIncreasepasswordsecurityIncreasingusersecurityImprovinguserexperienceItisnotapriority9Description:Duringa2023survey,morethan40percentofrespondentsamongdevelopersworldwidestatedthatincreasingtwo-factorauthenticationadoptionwastheirtopauthenticationpriority.Additionally,one-thirdofrespondentshighlightedincreasedpasswordsecurityastheirmainpriority.Bycontrast,onlytwopercentofrespondentsdidnotconsideredauthenticationapriority.ReadmoreNote(s):Worldwide;2023;600respondents;developersacrossvariousindustries.Source(s):BitwardenCHAPTER

02PasswordsecurityWhatareyourtopconcerns,ifany,whenitcomestohavingyourpersonalinformationonline?MainconcernsrelatedtohavingpersonalinformationonlineintheU.S.2023Shareofrespondents20%

30%0%10%40%50%60%70%68%80%IdentitytheftDatabreach39%Financialloss34%SharingofpersonaldatawithoutmyconsentSurveillancebycorporationsorgovernmentsEmbarrassing,disparagingimages/content32%18%9%11Description:Accordingtoa2023survey,themainconcernofAmericansrelatedtohavingtheirpersonalinformationonlinewasidentitytheft,highlightedbynearly70percentofrespondents.OthercommonconcernsintheUnitedStatesincludeddatabreachesandfinancialloss,asmentionedby39percentand34percentofrespondents,respectively.ReadmoreNote(s):UnitedStates;July2023;2,002respondentsSource(s):ForgeRock;PingIdentityIfyoucouldchangeonethingabouttheloginexperienceofthewebsitesandapplicationsyoufrequentlyuse,whatwoulditbe?MainareasforimprovementrelatedtotheloginexperienceintheU.S.2023Shareofrespondents0%5%10%15%20%20%25%SeamlessloginexperienceRememberpasswords16%Morebiometrics(e.g.FaceID,fingerprint)Morepersonalizedloginexperience15%14%Text/emailpromptwithone-timelogin13%Moreauthenticationoptionstoverifytheidentityoftheuser(e.g.QRcodelogin)Removepasswords10%5%12Description:Accordingtoa2023survey,themainareaforimprovementrelatedtotheloginexperienceofthewebsitesandapplicationsfrequentlyusedbyAmericanswasaseamlessloginexperience,highlightedby20percentofrespondentsintheUnitedStates.Rememberingpasswordsfollowed,accordingto16percentofrespondents.Bycontrast,onlyfivepercentofrespondentsmentionedremovingpasswordsaltogetherasapotentialimprovementrelatedtotheloginexperience.

ReadmoreNote(s):UnitedStates;July2023;2,002respondentsSource(s):ForgeRock;PingIdentityLeadingmethodsforkeepingpasswordssafeintheUnitedStatesasofDecember2023MainmethodsforkeepingpasswordssafeintheU.S.2023Shareofrespondents10%0%5%15%20%25%30%35%FaceID31%ApasswordmanagerFingerprintscanningtoaccessdevicesoraccountsGeneratedpasswords30%29%18%Noneoftheabove22%13Description:AsofDecember2023,asurveyamongAmericansrevealedthatnearlyone-thirdofrespondentskepttheirpasswordssafebyusingFaceID,while30percentusedapasswordmanager.Bycontrast,only18percentofrespondentsreportedusinggeneratedpasswords.ReadmoreNote(s):UnitedStates;December21to26,2023;2,000respondentsSource(s):Forbes;OnePollMostcommonpasswordmistakesintheUnitedStatesasofDecember2023LeadingpasswordmistakesintheU.S.2023Shareofrespondents5%

10%0%15%20%25%30%35%40%38%WritepasswordsdownRelyonmemorytorememberpasswordsUsethesamepasswordacrossmultipleaccountsStoremypasswordsonmycomputer35%32%24%UsethesamepasswordforworkaccountsonmypersonalaccountsSharepasswordswithfamilyorfriends14%8%14Description:AsofDecember2023,asurveyamongAmericansrevealedthatnearly40percentofrespondentswrotetheirpasswordsdown,while35percentreliedonmemorytorememberpasswords.OthercommonpasswordmistakesintheUnitedStatesincludedusingthesamepasswordsacrossmultipleaccountsandstoringthemoncomputer,asmentionedby32percentand24percentofrespondents,respectively.

ReadmoreNote(s):UnitedStates;December21to26,2023;2,000respondentsSource(s):Forbes;OnePollCHAPTER

03PasswordmanagerShareofpeopleusingpasswordmanagersintheUnitedStatesin2022and2023ShareofpeopleusingpasswordmanagersintheUnitedStates2022-202340%35%30%34%25%21%20%15%10%5%0%2022202316Description:Accordingtoa2023survey,theshareofAmericansusingapasswordmanagergrewfrom21percentin2022to34percentayearlater.Inanincreasinglydigitalizedworld,passwordmanagersallowusersasimplesolutionforprotectingandaccessingloginsonmultipledevicesacrosstheweb.ReadmoreNote(s):UnitedStates;2022and2023;1,000respondentsSource(s):SPasswordmanagerusageintheUnitedStatesin2023,bydevicePasswordmanagerusageintheU.S2023,bydevice90%84%77%80%70%60%50%40%30%20%10%0%44%MobilephoneLaptopordesktopcomputerTablet17Description:In2023,morethaneightoutoftenrespondentsintheUnitedStatesusedapasswordmanagerontheirmobilephones.Inaddition,morethanthree-quartersofrespondentsusedoneontheirlaptopordesktopcomputer.Moreover,44percentofrespondentsusedapasswordmanageralsofortheirtablet.ReadmoreNote(s):UnitedStates;2023;1,000respondentsSource(s):SLeadingpasswordmanagersintheUnitedStatesin2023MostpopularpasswordmanagersintheUnitedStates2023Shareofrespondents0%5%10%15%20%25%30%30%35%GooglePasswordManageriCloudKeychain(Apple)LastPass19%10%1Password8%Bitwarden7%Dashlane4%4%NordPassNorton3%3%KeeperMcAfeeTrueKeyPasswordBossOther2%1%5%18Description:Accordingtoa2023survey,GooglePasswordManagerwasthemostpopularpasswordmanagerintheUnitedStates,usedby30percentofrespondents.Apple'siCloudKeychainfollowed,withnearly20percentofusers.Inanincreasinglydigitalizedworld,passwordmanagersallowusersasimplesolutionforprotectingandaccessingloginsonmultipledevicesacrosstheweb.ReadmoreNote(s):UnitedStates;2023;1,000respondents;18yearsandolderSource(s):SAverageannualcostforapasswordmanagerintheUnitedStatesin2023AnnualpriceforapasswordmanagerintheU.S.202370%63%60%50%40%30%20%12%11%10%0%6%5%3%Free1-20USD21-40USD41-60USDMorethan60USDUnsure19Description:In2023,63percentofsurveyedrespondentsfromtheUnitedStatesstatedthattheyusedfreeversionsofpasswordmanagers.Only11percentofrespondentspaidbetweenoneand20U.S.dollarsfortheirpasswordmanager.

ReadmoreNote(s):UnitedStates;2023;1,000respondents;18yearsandolderSource(s):SMostimportantreasonsforusingapasswordmanagerintheUnitedStatesin2023MainreasonsforusingapasswordmanagerintheU.S.202380%68%70%60%50%40%30%20%10%0%53%45%40%22%18%IhavemorepasswordsthatIcanremembereasilyIusemyloginsacrossdevices(laptop,mobile,etc)IwantedtogeneratecomplexpasswordsIneededtomanagemultipleloginsforsomeapplicationsIwantedmypasswordsencryptedIonlywantedtorememberonepassword20Description:ThemostimportantreasonforusingapasswordmanagerintheUnitedStatesin2023wasthatpeoplecouldnotrememberalltheirpasswords.Additionally,53percentofrespondentspreferredapasswordmanagerbecausetheyusedtheirloginsacrossdifferentdevices.ReadmoreNote(s):UnitedStates;2023;1,000respondents;18yearsandolderSource(s):SMostimportantreasonsfornotusingapasswordmanagerintheUnitedStatesin2023MainreasonsfornotusingapasswordmanagerintheU.S.202330%28%27%25%20%15%10%5%16%15%9%4%0%They'renotsecureNotsureIneedoneTheycosttoomuchIdon'tknowhowthey

They'retoohardtosetupworkOtherreasons21/statistics/1303478/us-reasons-for-not-using-a-password-managerIn2023,themostimportantreasonfornotusingapasswordmanagerintheUnitedStateswasthatpeopledidnotbelieveitwassecure.Anotherequallyimportantreasonwastheyrespondentswerenotsuretheyneededapasswordmanager.

ReadmoreNote(s):UnitedStates;August2023;1,051respondents;18yearsandolder;Americanadults.Source(s):SCHAPTER

04PasswordbehaviorTypicalpasswordstoragehabitsinselectedcountriesin2023Typicalpasswordstoragehabitsinselectedcountries202335%31%30%24%25%20%15%10%5%12%11%9%5%5%3%0%AnotebookRememberthem

Saveinpassword

Istoretheminmy

Saveinbrowser

Adocumentonmy

Storeinemail

Resetateachloginwithoutwritingdownmanagerapplication(e.g.LastPass,iCloudkeychain)phone(e.g.GoogleChrome)computer(electronicformat)23Description:In2023,over30percentofrespondentsintheUnitedStates,theUnitedKingdom,Canada,Germany,France,andNewZealandrememberedtheirpasswordsbywritingthemdowninanotebook.Only12percentofthemusedapasswordmanager,whileanotherninepercentsavedtheirpasswordsinthebrowser.ReadmoreNote(s):Canada,France,Germany,NewZealand,UnitedKingdom,UnitedStates;April13to27,2023;5,403respondents;18yearsandolderSource(s):BusinessMachineTechnologies;CybSafe;NationalCybersecurityAllianceTypicalpasswordlengthinselectedcountriesin2023,bygenerationAveragepasswordlengthinselectedcountries2023,bygenerationGenZMillennialsGenXBabyBoomers50%SilentGen60%50%40%30%20%10%0%48%45%

45%44%35%31%28%26%23%19%

19%

19%14%13%10%8%7%4%3%3%2%

2%6charactersorless1%

1%7-8characters9-11characters12-15characters16charactersorlonger24Description:In2023,themajorityofrespondentsfromtheUnitedStates,UnitedKingdom,Canada,France,Germany,andNewZealandstatedthattheirtypicalpasswordlengthwasbetweennineto11characters,regardlessoftheirgeneration.While10percentofGenZrespondentsreportedhavingapasswordlongerthan16characters,thisproportionwasonlyfourpercentamongBabyBoomers.

ReadmoreNote(s):Canada,France,Germany,NewZealand,UnitedKingdom,UnitedStates;April13to27,2023;5,748respondents;18yearsandolderSource(s):BusinessMachineTechnologies;CybSafe;NationalCybersecurityAllianceFrequencyofusinguniquepasswordsfordifferentonlineaccountsinselectedcountriesin2023Usinguniquepasswordsfordifferentonlineaccountsinselectedcountries202340%35%30%25%20%15%10%5%38%29%14%14%5%0%AllofthetimeThemajorityofthetimeHalfofthetimeSomeofthetimeNoneofthetime25Description:In2023,nearlyfouroutof10respondentsfromtheUnitedStates,UnitedKingdom,Canada,France,Germany,andNewZealandstatedthattheyalwaysusedauniquepasswordforeachonlineaccount.However,fivepercentofrespondentsusedthesamepasswordacrossalltheiraccounts.ReadmoreNote(s):Canada,France,Germany,NewZealand,UnitedKingdom,UnitedStates;April13to27,2023;6,064respondents;18yearsandolderSource(s):BusinessMachineTechnologies;CybSafe;NationalCybersecurityAllianceFrequencyofchangingonlinepasswordsinselectedcountriesin2023Frequencyofchangingonlinepasswordsinselectedcountries202340%34%35%30%25%20%15%10%5%31%11%11%8%5%0%Idon'tchangepassword(s),unlessIhavetoEveryfewmonthsIchangesomeofthemmoreoftenthanothersYearlyLessthanyearlyNever26Description:In2023,themajorityofrespondentsfromtheUnitedStates,UnitedKingdom,Canada,Germany,France,andNewZealandstatedthattheydidnotchangetheirpasswords,unlesstheyhadto.Additionally,another31percentansweredthattheychangedthemeveryfewmonths.ReadmoreNote(s):Canada,France,Germany,NewZealand,UnitedKingdom,UnitedStates;April13to27,2023;6,064respondents;18yearsandolderSource(s):BusinessMachineTechnologies;CybSafe;NationalCybersecurityAllianceMainactionstakenwhenchangingpasswordsinselectedcountriesin2023Actionstakenwhenchangingonlinepasswordsinselectedcountries2023GenZMillennialsGenXBabyBoomersSilentGen70%60%50%40%30%20%10%0%62%60%50%35%34%26%25%20%19%19%18%17%16%14%14%13%13%13%10%8%4%3%

3%3%1%IchangeoneortwocharactersonmyexistingpasswordIchangeawordortwoIusepasswordssuggestedbywebsitesorapplicationsIchangemypassworldtosomethingcompletelydifferent(Ihavemyowntechnique)Ichangemypasswordusingthepassphrasetechnique(e.g.threerandonwords)27Description:In2023,themajorityofrespondentsfromtheUnitedStates,UnitedKingdom,Canada,France,Germany,andNewZealand,regardlessoftheirgeneration,statedthatthemainactiontakenwhenchangingoneoftheironlinepasswordswastochangeitcompletely.OnlyeightpercentofrespondentsamongBabyBoomersusedpasswordssuggestedbywebsitesorapplications,whilethissharereached26percentamongGenZrespondents.

ReadmoreNote(s):Canada,France,Germany,NewZealand,UnitedKingdom,UnitedStates;April13to27,2023;4,983respondents;18yearsandolderSource(s):BusinessMachineTechnologies;CybSafe;NationalCybersecurityAllianceCHAPTER

05BeyondpasswordsMainadvantagesofpasswordlesssauthenticationworldwidein2023Mainbenefitsofpasswordlesssauthenticationworldwide202350%45%40%35%30%25%20%15%10%5%0%ImproveuserexperiencetoincreaseStrengtheningcybersecurityIncreaseMovingawayfrominsecurelegacyMeetingcyber

Improvingsupply

SupportingaMeetingcompliancerequirementsSimplifyingIAMinfrastructureemployeeinsurancechainsecurityZeroTrustinitiative(reducebreach

adoptionofMFArequirementsproductivityrisk)throughbetteruserexperiencetechnologies29Description:Withtheriseofhomeofficeanditschaoticenvironment,it'snosurprisethatpasswordlessauthenticationisgainingtraction.In2023,45percentofrespondentsmentionedImproveuserexperiencetoincreaseproductivityasthemainadvantageofpasswordlessauthentication,whileanother43percentmentionedstrengthenedcybersecuritybenefits.ReadmoreNote(s):Worldwide;2023;1,000respondents;ITsecuritydecisionmakersfromorganizationsranginginsizefrom50employeestolargeenterprisesSource(s):HYPR;VansonBourneDoesyourorganizationplantoadopt,oruse/continuetousepasswordlessauthenticationinthenext1-3years?Futureadoptionofpasswordlessauthenticationbyvariousindustriesworldwide202345%41%39%40%35%30%25%20%15%10%5%34%33%33%31%28%19%0%RetailFinancialservices

ITandtechnologyManufacturingHealthcareEnergy/utilitiesOtherTotal30Description:In2023,theretailandfinancialservicesindustrieswerethemostlikelytoadoptpasswordlessauthenticationinthenextonetothreeyears,ashighlightedby41percentand39percentofrespondents,respectively.Intotal,overone-thirdofrespondentsacrossindustriesworldwidewereplanningtoadoptpasswordlessauthenticationinthenearfuture.ReadmoreNote(s):Worldwide;2023;1,000respondents;ITsecuritydecisionmakersfromorganizationsranginginsizefrom50employeestolargeenterprisesSource(s):HYPR;VansonBourneWhattechnicalsolutions,ifany,areyoureplacing/expectingtoreplacepasswordswith?MainsolutionstoreplaceworkplacepasswordsintheUnitedStates2023Shareofrespondents0%

10%20%30%40%50%60%58%70%Biometricssuchasfacialrecognition,fingerprintscans,irisscans,orvoiceverificationMulti-FactorAuthenticationOne-TimePasswords(OTP),magiclinks,QRcodesSecuritykeyssuchasYubicoPasskeys46%37%37%35%34%PINcodesSingleSign-On(SSO)30%Passphrases26%31Description:In2023,whenaskedwhattheywerereplacingorexpectingtoreplaceworkplacepasswordswith,nearly60percentofrespondentsamongITandcybersecurityleadersintheUnitedStatesmentionedbiometricssuchasfacialrecognition,fingerprintscans,irisscans,orvoiceverification.Inaddition,around46percentofrespondentsstatedthattheircompanyhadreplacedorwasplanningtoreplaceworkplacepasswordswithMulti-FactorAuthentication.Passkeysconstitutedanotherpopular[...]

ReadmoreNote(s):UnitedStates;2023;300respondents;ITandcybersecurityleadersfromcompaniesofdifferentsizesacrossvariousindustriesSource(s):DelineaWhat,ifanything,doyoubelievestands/wouldstandinthewayofyourworkplacegoingpasswordless?MainobstaclestogoingpasswordlessintheUnitedStates2023Shareofrespondents0%

5%10%15%20%25%30%28%35%33%40%45%43%50%Weuselegacyplatformsandapplicationsthatrequirepasswordsandpassword-basedMFAWeneedeveryonetobeabletousethesameauthenticationmethodeverywhereOurITandsecurityteamsdon’talignonhowtomakeithappenOuremployeesdon’ttrustordon’tunderstandpasswordlessprocessesWedon’thavetheappropriatehardwaretosupportpasswordlessprocessesIdentitiescouldnotbeadequatelyverified37%24%24%23%Wedon’thavethebudgettosupportapasswordlessfutureWed