Users are still clinging to hopes for the best without preparing for the worst, even with two-factor authentication and identity management advancements.