Every year, World Password Day(May 7) serves as a timely reminder that how we authenticate who we are online has real consequences for individuals, for businesses, and for national security. As someone working at the intersection of identity strategy and enterprise security, I see firsthand how quickly the threat landscape is evolving and how many organizations are still playing catch-up.
The biggest password/security mistakes people are still making today
Claude Leroux, Okta: People are still reusing passwords across multiple accounts, which makes one breach far more damaging than it should be. Many organizations also rely too heavily on passwords alone, even though they are easy to steal or guess. The result is that attackers often don’t need to be sophisticated to get in. Security practices still matter, but they are no longer enough on their own.
How AI is changing the threat landscape (good or bad)
Claude Leroux, Okta: AI is radically altering the threat landscape by powering scale and precision. For attackers, it streamlines the creation of highly convincing social engineering attacks, putting immense pressure on identity management systems.
For defenders, AI is a force multiplier, allowing for the detection of anomalies that human analysts might miss. Ultimately, the ‘good’ or ‘bad’ of AI depends on who can innovate faster: the attacker aiming for credentials, or the defender protecting the identity.
Practical tips for individuals and businesses to stay secure in 2026
Claude Leroux, Okta: Start by moving away from passwords where possible and using stronger sign-in methods like passkeys or multi-factor authentication. Avoid reusing passwords and use a password manager so you are not relying on memory or patterns that are easy to guess. For businesses, investing in a modern identity and access management strategy, knowing who has access to what, and revoking it when it’s no longer needed, is foundational.
And verify access continuously rather than assuming a login is trusted once it succeeds. Most security issues still begin with compromised credentials, so reducing that risk has the biggest impact.
The future of passwords (passwordless, biometrics, etc.)
Claude Leroux, Okta: The role of passwords is shrinking because they are too easy to compromise and too difficult to manage at scale. At Okta, we’re seeing organizations treat identity as a core part of their security strategy, not something layered on after the fact.
The move toward passkeys and biometrics is already underway, and it’s pushing companies to think more broadly about how they secure every identity, human or machine. That shift is what will define how authentication works going forward.
World Password Day is ultimately about awareness — but awareness alone doesn’t protect anyone. The good news is that the tools and strategies to significantly reduce identity-based risk exist today and are more accessible than ever. Whether you’re an individual finally ready to set up a password manager, or an enterprise rethinking your access management approach, the best time to act is now. Identity is the new perimeter, and securing it is no longer optional.
