Authenticating who is truly behind any action, whether it’s logging into Twitter or accessing a bank account, is the biggest challenge in security today.

At the enterprise level, this reality is infinitely more critical: businesses need to completely secure access to their systems and data, and be certain that only those who are granted access have it. At the same time, companies must also make sure their employees are able to work as productively as possible — and constant and stringent security protections would certainly get in the way of “business as usual.” These situations create a dichotomy that firms and security experts have struggled to overcome.

To date, PINS, passwords and OTP hardware have been the compromise of choice: enough to authenticate a user’s access, but not so burdensome that employees can’t get their jobs done. The problem? They don’t work. In 2016, the – including headline-making cases like Yahoo! and the DNC — all involved compromised, weak or reused passwords. That’s more than troubling — that’s a call for a total security reset.

Still, if the security issue isn’t convincing enough, just take a :

.

There are many things to consider on the journey to killing enterprise passwords, but thanks to mobile devices, hardware doesn’t need to be one of them.

This article is published as part of the IDG Contributor Network.