You didn't hire yourself to reset passwords. Neither did anyone else.
By Tony Greenberg · Impact Futurist · Founder, RampRate & ImpactSoul
$70 — Cost per password reset ticket (Forrester)
10.9h — Hours/year per employee lost to passwords
301 — Avg passwords managed per person in 2025
50% — Of help desk calls are password resets
$5.2M — Annual productivity loss per enterprise
It was 7:02 PM. I watched two back-to-back Navan login emails detonate in my inbox — a password reset, then a magic link, then a completely blank white page at auth.navan.com that did absolutely nothing. Not a spinner. Not an error message. Just white. Peaceful. Like a Zen koan about modern enterprise software.
Half my day was already gone to this exact loop. Not to a vendor problem. Not to a security crisis. To the authentication layer. The most expensive, most tolerated, most quietly insane tax on human productivity in the modern enterprise.
Field Notes From the Trenches
I have now spent more time this year trying to log into travel software than I spent actually traveling. This is not a metaphor. This is a calendar event.
Here's the number that should make your board twitch: a single enterprise password reset ticket costs $70 in help desk labor alone, with an additional 15 to 30 minutes of productivity loss per user per incident. For a 5,000-person company at 30% annual reset volume, that's $105,000 in help desk costs before you count the time of the humans who can't work while waiting. Total annual drag: $350,000 to $1.5 million. Sitting right there. Under "IT overhead." Next to the kombucha budget.
The average person now manages 301 passwords. That number has grown 25% in a single year. At some point, "security" stopped meaning "protection from external threats" and started meaning "protection from the employee ever getting any actual work done."
We built a system where the most consistent daily experience of your digital infrastructure is being suspected of being yourself.
This is not a security article. This is a productivity article. And an argument. The argument is simple: we have allowed a broken, 1960s-era authentication model to metastasize into a full-time job for everyone inside every organization. The fix has existed for years. We're just too habituated to the pain to demand it.
Consider what you're actually doing when you reset a password. You are proving to a machine — one you pay for, on a network you own, via a device you purchased — that you are, in fact, you. And the machine is not convinced. So it sends a code to your phone. Except the code expires in 30 seconds. And your phone is in the other room. And when you come back, a new code has already arrived and the old screen is gone. You are now in a time-loop that would make Christopher Nolan uncomfortable.
The Definitive List: 10 Things They Need to Fix. Yesterday.
01 — UX CRIME: The Magic Link That Goes Nowhere
You click the email. Safari opens. White screen. The link expired in 60 seconds while Gmail was loading. This is not a niche problem — it is endemic to every auth system that uses short-lived email tokens without graceful fallback. Fix: tokens that survive the mobile browser handoff. Or better — stop using email links entirely. "Magic link" is not magic if it vanishes before the rabbit appears.
02 — SECURITY THEATER: MFA Codes That Expire Before You Can Type Them
TOTP codes rotate every 30 seconds. The average mobile-to-app context switch takes 8 to 12 seconds. On a bad day — wrong app open, code just flipped — you're copying a code that expired mid-paste. You now get to do it again, faster, with more adrenaline, like a very boring video game. 62% of Americans with high password fatigue have been hacked, versus 29% of those with low fatigue. The 30-second window is not making anyone safer. It is making everyone more frantic.
03 — CIRCULAR LOGIC: Password Reset Emails That Go to the Wrong Account
Enterprise email forwarding, alias management, and the classic personal-vs-work account confusion means the reset lands in an inbox you can't access from where you're locked out. A circular dependency with no exit. This is the authentication equivalent of your house key being inside the house.
04 — CALENDAR MATH: "Verify With Your IT Admin" — Who Is In a Different Time Zone
Average wait times of 2 to 24 hours for traditional help desk password resolution. A company with 1,000 employees experiencing one reset per person annually loses $50,000 in productivity. Now add executive time. Now add the three Slack messages sent asking "anyone know how to reach IT?" Now add the workaround the employee eventually uses that creates a security vulnerability. Congratulations, the $70 reset ticket just became a $700 incident.
05 — FALSE PROMISE: SSO That Doesn't Actually Cover Every App
Single Sign-On was supposed to solve this. It didn't. Because every vendor has their own auth layer, their own session management, and their own unique opinion about what "logged in" means. SSO: the promise of one login, the reality of eleven.
06 — COMPLIANCE THEATER: Session Timeouts Set to Punish, Not Protect
Most enterprise security policies set session timeouts based on what compliance documentation suggests rather than actual threat modeling. 15-minute lockouts on an internal tool you use continuously. Re-auth every hour for a dashboard you are actively working in. Authentication fatigue is documented, real, and makes users less vigilant, not more secure. You have achieved the opposite of your goal. Well done.
07 — NIST DEPRECATED THIS: The Phone Number That Changed Three Jobs Ago
SMS-based MFA is tied to a phone number. You changed phones, or carriers, or countries. NIST's July 2025 update to SP 800-63-4 officially states that SMS OTP does not satisfy AAL2 phishing-resistant requirements. We are using a security measure that the government's own standards body has deprecated. We are very brave.
08 — UX CRIME (REPEAT OFFENDER): Apps That Silently Deauthenticate in the Background
You are mid-meeting. You switch to a tool you used an hour ago. Locked out. Silently, without warning. No banner. No countdown. Just a login screen where your work was, staring at you with the cold neutrality of a machine that does not care about your 2pm deadline.
09 — DEVICE PARANOIA: Multi-Device Auth That Treats Every Device Like a Threat
You are on your laptop. Your phone. Your iPad in a meeting. Each device is treated as a new, suspicious actor requiring full re-authentication. 63% of employees spend more than 10 minutes per day just managing passwords. That is over 40 hours per year per employee — a full work week — stolen by a system that cannot distinguish between Tony on his iPhone and an unknown bad actor in Minsk.
10 — ROOT CAUSE: No Unified Identity Layer Across the Stack
There is no canonical identity layer that knows who you are across your entire software stack. You exist as a different user in every tool. There is no reputation, no history, no trust score. Every authentication event starts from zero. You have 25 years of professional history, thousands of verified interactions, and a creditworthy digital footprint — and the expense management app you've used for four years still doesn't know if you're you. That's not a security model. That's institutional amnesia by design.
Honest Accounting
I would like to formally submit that the collective hours lost by American knowledge workers to authentication loops in 2025 constitute a greater economic loss than several medium-sized natural disasters. I cannot prove this. But I feel it.
The Real Threat: How to Make Yourself AI-Proof
Here is what changed: AI-powered credential attacks are no longer a future threat. They are the present operating environment. Infostealers extracted 548 million passwords from compromised endpoints in 2024 alone. Credential-based attacks were the single most common breach vector in 2025, appearing in more than half of all data breaches.
The question is no longer "how strong is my password?" The question is: "does my authentication method depend on a secret that can be phished, cloned, or purchased on a dark web market for $0.50?"
AI CAN BREAK THIS — SMS / Voice OTP
SIM swap attacks. SS7 protocol vulnerabilities. Real-time phishing proxies that relay the code before it expires. NIST deprecated this at AAL2 in July 2025.
AI CAN BREAK THIS — Password + Any Shared Secret
If it's a secret you know and type, it can be phished. 548 million passwords were stolen in 2024. Yours is somewhere in there. Statistically.
GETTING WEAKER FAST — Email Magic Links
Better than SMS, but email accounts are compromise targets. Transitional technology at best.
ADEQUATE, NOT EXCELLENT — TOTP Authenticator Apps
Real-time phishing proxies can relay TOTP codes in the 30-second window. Good as a second factor. Not sufficient as the primary gate on high-value accounts.
AI CANNOT CLONE THIS — FIDO2 Passkeys
Cryptographically bound to a specific domain. The private key never leaves the device. There is no secret to phish because the credential itself is not transferable. HubSpot saw 4x faster logins and 25% higher login success rates after deployment. This is the answer.
HIGHEST ASSURANCE (AAL3) — Hardware Security Keys
YubiKey, Google Titan Key. Physical FIDO2 device. The private key lives in hardware and cannot be exported even if the device is compromised. Required for NIST AAL3. The gold standard for accounts that matter.
The AI-Proof Stack in Order of Priority
- Audit your SMS exposure today. Every account using SMS MFA is a SIM swap liability. List them. Replace them.
- Deploy passkeys on everything that supports them. 92% of CISOs are implementing or planning to implement passwordless authentication — up from 70% in 2024.
- Hardware keys for your highest-value accounts. Email, banking, domain registrar, cloud infrastructure, password manager. A $50 YubiKey protecting a $500,000 SaaS platform is the highest ROI security spend in your budget.
- A password manager that supports passkey sync. 1Password, Bitwarden, and Dashlane all now sync passkeys across devices.
- Retire SMS MFA from anything that matters. Keep it as a last-resort fallback if you must. But it is not a security layer. It is a compliance checkbox with a liability attached.
The Uncomfortable Truth
The authentication industry has successfully convinced enterprises that suffering is security. The more painful the login, the more secure the feeling. This is not a correlation. It is a sales strategy. Passkeys are faster than passwords. They are also more secure. The tradeoff you were sold does not exist.
Authentication Is a Trust Problem Wearing a Security Costume
Here's the thing nobody says out loud: every login screen is a system asking "Do I know you?" And the answer, in most enterprise stacks, is: "Not really. Prove it again. And again. And again." The machine does not accumulate any understanding of you. It starts over from zero every time. It has no memory. It has no history. It has no model of trust.
ImpactSoul is built on the opposite premise. The governing thesis is "Only Time Buys Trust" — meaning trust is earned through contribution history, through verified presence, through the accumulation of signal over time. A contribution ledger doesn't ask you to prove you exist every 15 minutes. It knows you exist because you've been here, doing the work, leaving a trail.
The passkey is a step toward that world. ImpactSoul is building the layer above it — the one that binds access to contribution, reputation, and verified trust equity compounded over time. That's what institutional amnesia by design looks like when you finally fix it.
The Verdict: Stop Performing Security. Start Delivering Access.
The password reset loop is not a minor inconvenience. It is a structurally broken system absorbing billions in human productivity while providing diminishing security returns. The technology to replace it exists, is affordable, and is being adopted by every serious security organization in 2026.
- Deploy a passkey-capable password manager this quarter. Bitwarden at $6/user is the value play. 1Password at $7.99 is the UX play. Both are correct.
- Audit your session timeout policies against actual threat models, not compliance document defaults.
- Consolidate your auth stack behind a real SSO layer. Okta for large orgs. Auth0 for developer-first builds.
- Retire SMS MFA. Today. NIST already did it for you officially. You're just catching up.
- Issue YubiKeys to every executive, admin, and infrastructure owner. $50 to $80 per device. Best security ROI in the building.
Bibliography & Sources
Every fact, cited. You're welcome. (Because if we're going to be outraged, we should be accurately outraged.)
01 — Yubico / Ponemon Institute Study
IT professionals spend an average of 12.6 minutes per week entering and resetting passwords. Translates to 10.9 hours annually per employee and $5.2 million per year in lost organizational productivity. Source: Yubico-Ponemon 2023 State of Authentication Report
02 — Forrester Research / Gartner
A single help desk password reset ticket costs between $70 and $100 in labor. Password-related issues account for 20-50% of all help desk calls. Source: Forrester TEI Study · Gartner IT Research 2024
03 — Enterprise Productivity Loss Per Reset
Workforce productivity loss of 15-30 minutes per user per reset event. At a fully-loaded $40-60/hour, 25 minutes costs $17-$25 per incident. Source: Avatier Credential Governance 2026 Guide
04 — Dashlane Password Report 2025
The average person manages 301 passwords across personal and work accounts, up 25% in a single year. Source: Dashlane Passkey Power 20 Report, October 2025
05 — Beyond Identity Password Fatigue Study
62% of high-fatigue users had accounts hacked vs 29% of low-fatigue users. Companies lose $480/year per employee in password-related productivity loss. Source: Beyond Identity Research Study, 2024
06 — Ping Identity Employee Survey
63% of employees report spending more than 10 minutes per day managing passwords — 40+ hours per year per employee. Source: Ping Identity 2024 State of Digital Identity Report
07 — NIST SP 800-63-4 (July 2025 Update)
SMS OTP explicitly does NOT satisfy AAL2 requirements. Synced passkeys (FIDO2) officially satisfy AAL2. Hardware-bound keys satisfy AAL3. Source: NIST SP 800-63-4, published July 2025
08 — Wakefield Research / Portnox CISO Survey
92% of organizations had implemented or were planning to implement passwordless authentication in 2025, up from 70% in 2024. Source: Wakefield Research / Portnox 2025
09 — Verizon Data Breach Investigations Report 2025
Credential-based attacks were the single most common initial breach vector. Source: Verizon Data Breach Investigations Report 2025
10 — Akamai State of the Internet
Infostealer malware extracted over 548 million passwords from compromised endpoints in 2024 alone. Source: Akamai State of the Internet Report 2025
11 — HubSpot Passkey Deployment Results
25% improvement in login success rates over passwords. 4x faster time to login compared to passwords and 2FA. Source: HubSpot CISO Alyssa Robinson via Dashlane Passkey Report 2025
12 — Enterprise Password Manager Market Size
The enterprise password management market reached $3.2 billion in 2026, growing at 16.8% CAGR. Source: Persistence Market Research 2026
