Passwordless programmes break when help-desk resets, emergency bypasses, or password recovery paths remain available without strong controls. Attackers often target the easiest path, so a strong primary factor does not compensate for a weak secondary process. The entire authentication journey has to be governed as one system.