Speaking as a consultant, let me tell you that literally none of my clients over the past three years had a password reset authentication policy. Employee just

Speaking as a consultant, let me tell you that literally none of my clients over the past three years had a password reset authentication policy. Employee just calls IT, and they reset the pw on the spot with no checks whatsoever. Keep in mind that pretty much everyone hates passwords, and a lockout constitutes a work stoppage. Adding any additional friction is resisted at every level from the C-suite to the janitor. I try to mitigate it by proposing self-service workflows, and that's popular, but the IT hotline reset is incredibly difficult to get rid of.