Authentication complexity is still blocking passwordless adoption

At a glance

What this is: This is Axiad’s analysis of a 252-executive survey showing strong passwordless intent but persistent authentication complexity across enterprise environments.

Why it matters: IAM teams need to treat passwordless as an operating model change, because complexity, friction, and fragmented controls can derail human authentication programmes before they deliver risk reduction.

By the numbers:

• Axiad’s 2022 Authentication Survey included 252 U.S. security and IT executives at organisations with 2,500 or more employees.
• 86% of respondents plan to implement a passwordless strategy in the next 12 months, or already have done so.
• 70% of survey respondents said they are overwhelmed by the complexity of their authentication systems.
• 42% of respondents said their organisation’s biggest authentication challenges involve a lack of visibility across all authentication practices.

Context

Authentication complexity is the accumulated friction, visibility gaps, and fragmented controls that make it hard to operate secure login systems at enterprise scale. In this article, Axiad uses a survey of U.S. security and IT executives to show that passwordless ambition is already high, but execution still runs into operational complexity.

For human IAM programmes, the problem is not whether organisations want to move away from passwords. The harder issue is whether the authentication stack, admin processes, and user experience can be aligned well enough to make passwordless practical instead of aspirational.

The article is best read as a governance warning: authentication modernisation fails when teams treat identity UX, risk management, and infrastructure ownership as separate workstreams. That fragmentation is typical in large organisations and explains why adoption intent can outrun delivery.

Key questions

Q: What breaks when authentication is too complex for passwordless adoption?

A: Passwordless programmes fail when the surrounding authentication estate is fragmented across silos, recovery paths, and exception processes. Users then fall back to workarounds, administrators inherit manual overhead, and the organisation ends up with inconsistent enforcement instead of simpler access. The failure is operational, not just technical.

Q: Why does authentication complexity create security risk for IAM programmes?

A: Complexity creates risk because it fragments control ownership, weakens visibility, and makes policy enforcement inconsistent across systems. Once authentication is split across silos, teams cannot reliably tell which users, applications, or privileged paths are using approved methods. That opens the door to bypasses, shadow recovery flows, and control drift.

Q: How do IAM teams know whether passwordless adoption is actually working?

A: They should look for fewer lockouts, fewer reset requests, shorter time to access, and lower dependence on help desk intervention. Adoption is only successful if the new method is secure and easier for employees to use than the old one. Metrics should show both improved assurance and reduced operational drag.

Q: How can organisations balance authentication security and usability?

A: Use risk-based controls that raise friction only when the access request warrants it. If every login feels equally hard, users look for shortcuts; if every login is equally easy, assurance drops. Good programmes tune controls to application sensitivity, device context, and session risk.

Technical breakdown

Why authentication sprawl undermines passwordless rollout

Passwordless does not remove authentication complexity, it changes where the complexity lives. Enterprises still have to coordinate directories, device trust, credential recovery, exception handling, and policy enforcement across multiple systems. When those controls sit in silos, the user journey becomes inconsistent and administrators inherit brittle workflows. The result is not just poor usability. It is a governance problem, because any authentication design that only works in the clean path will be bypassed in the real one.

Practical implication: Map the full authentication journey before expanding passwordless so exceptions, recovery, and fallback paths are governed as one system.

Visibility across authentication practices is the hidden control gap

Visibility is what lets security teams know which methods are in use, where they are allowed, and where they are bypassed. Without it, organisations cannot tell whether passwordless is actually replacing legacy authentication or just sitting beside it as another option. Fragmented visibility also weakens risk response, because the team cannot see where the highest-friction or highest-risk paths are concentrated. In practice, poor observability means controls look stronger on paper than they are in production.

Practical implication: Inventory authentication methods and policy exceptions together so teams can see where legacy paths still weaken the programme.

User friction becomes a security control issue when it drives bypass behaviour

The article ties end-user friction to bypass behaviour, which is the key operational insight. When authentication is too cumbersome, users find workarounds that reintroduce risk even if the official control set looks mature. That makes usability part of the security boundary rather than a separate experience metric. For human IAM, the design question is not whether a control is secure in isolation, but whether people will actually use it when workflows are under pressure.

Practical implication: Measure bypass behaviour and abandonment rates as security outcomes, not just adoption metrics.

NHI Mgmt Group analysis

Authentication complexity is now a governance constraint, not just a usability nuisance. The survey shows that passwordless intent is already widespread, but implementation still collides with fragmented architecture and operational sprawl. That means the limiting factor is programme design, not stakeholder awareness. Practitioners should treat authentication complexity as a structural risk to IAM outcomes.

Visibility failure is the most underappreciated blocker in passwordless adoption. If security teams cannot see which methods, silos, and exceptions are active, they cannot govern the transition away from passwords with confidence. This is not a reporting issue alone. It is the control plane problem that determines whether policy can actually be enforced.

User friction is a security signal when people route around controls. The article correctly connects friction, administrator workload, and bypass behaviour. That combination shows why authentication programmes collapse when they optimise for control strength without equal attention to adoption path and operational load. In human IAM, the control only works if the workforce can sustain it.

Passwordless adoption exposes the identity attack surface that legacy authentication hid. Once teams remove passwords, they must manage recovery paths, device trust, exception handling, and admin processes with much tighter discipline. The hard part is not the new factor itself, but the orchestration around it. Practitioners should reframe passwordless as an enterprise operating model change.

Authentication modernisation succeeds when architecture, administration, and experience are designed together. The survey findings point to a familiar pattern across IAM programmes: isolated improvements create local wins but global inconsistency. Teams need an integrated view of identity controls, because passwordless will not fix fragmentation by itself. The programme has to be governed as one authentication system.

What this signals

Passwordless adoption depends on reducing operational complexity, not just replacing one login method with another. When authentication journeys span multiple silos, organisations create exceptions that weaken policy consistency and make human IAM harder to govern at scale.

User friction should be treated as a security metric. If employees, partners, or administrators routinely work around the approved authentication path, the programme is signalling that control design and operational reality are out of sync.

For practitioners

• Assess authentication sprawl end to end Catalogue all active authentication methods, fallback paths, and exception workflows before expanding passwordless. The goal is to see where legacy methods still coexist with modern controls and where users can sidestep policy.
• Measure visibility across authentication controls Track which applications, populations, and recovery paths remain outside central visibility. If the team cannot show where each authentication method is used, it cannot prove that the passwordless programme is reducing risk.
• Reduce user friction in high-volume journeys Prioritise the login and recovery journeys that generate the most support tickets, reset activity, or abandonment. Friction at scale drives workarounds, and workarounds are where security controls start to fail.
• Automate administrative recovery tasks Automate routine workflows such as expired certificate handling and access resets so administrators are not forced into manual exception management. Lowering administrative effort is part of keeping authentication controls sustainable.
• Align security and usability metrics Review whether programme metrics reward policy coverage alone or whether they also capture user abandonment, bypass behaviour, and support burden. A passwordless programme that nobody can operate cleanly will not stay secure in production.

Key takeaways

• Authentication modernisation stalls when the enterprise authentication estate is fragmented and hard to see end to end.
• The survey shows strong appetite for passwordless, but adoption intent does not remove the administrative and user-experience barriers that slow delivery.
• Teams that want passwordless to stick need to govern recovery, exception handling, and user friction as part of the same IAM programme.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Authentication Complexity: The operational burden created by multiple login methods, recovery paths, exceptions, and disconnected policy controls. It becomes a governance issue when users, administrators, and applications cannot follow one consistent authentication model across the enterprise.
• User Friction: The operational effort a person must spend to complete an access or security workflow. High friction is not just a usability issue. It often predicts help-desk load, policy bypass behaviour, and failed adoption of otherwise sound identity controls.
• Authentication Visibility: The ability to see which authentication methods, policies, and exception paths are active across the estate. Without it, teams cannot tell whether modern authentication is replacing legacy access patterns or merely existing beside them.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.