Key findings from SailPoint's 2016 Market Pulse Survey included the following:

• Poor password hygiene continues to plague enterprises. The majority of respondents (65%) admitted to using a single password among applications and one third share passwords with co-workers.
• Employees do not assume responsibility for protecting the integrity of corporate security processes. One in five employees would sell their passwords to an outsider. Of those who would sell their passwords, 44% would do so for less than $1,000. This is up from the one in seven who said they would sell a password a year ago, according to the report.
• Organizations are struggling to keep up. One in three employees admitted to purchasing a SaaS application without IT's knowledge (a 55% increase from last year's report). Alarmingly, more than 40% of respondents reported having access to a variety of corporate accounts after leaving their last job.

"This year's Market Pulse Survey shines a light on the significant disconnect between how employees view their personal information and that of their employer, which could also include personal information of customers," Kevin Cunningham, president and founder of SailPoint, said. "Today's identity governance solutions can alleviate the challenge of remembering several passwords and automate IT controls and security policies, but it's imperative that employees understand the implications of how they adhere to those policies. It only takes one entry point out of hundreds of millions in a single enterprise for a hacker to gain access and cause a lot of damage."

John Barco, vice president of global product marketing at the San Francisco-based access management and identity management firm ForgeRock, said, "The news about employees willing to sell their login credentials is worrying, and reinforces the need for organizations to adopt security practices and technologies that go beyond simple passwords. Ideally, trusted device management and continuous security checking will become mainstream. For example, linking trusted, previously registered devices to individuals and logins would help to cut down on the risks associated with credential theft or credential selling,"

Barco said continuous security checking, in which an identity management solution would track for factors such as differences in request location over time, can also help to provide greater security.

"In the instance of someone selling their work login, for example, if that password ultimately fell into the hands of a hacker based in Eastern Europe, it would no longer work because a) the device the hacker is using wouldn't be recognized, and b) the distant, unrecognized location would prompt greater scrutiny."