Credential strategy and passwordless scale: Versasec’s leadership lens

At a glance

What this is: Versasec’s chairman frames growth around password replacement, operational discipline, and credential lifecycle control for enterprise authentication.

Why it matters: It matters because passwordless and Zero Trust initiatives only hold if IAM, PAM, and lifecycle governance can scale with credential issuance, revocation, and audit needs.

By the numbers:

• Torvald Bohlin says he has nearly 45 years of experience across executive roles in business, telecom, media, IT, and financial services.

👉 Read Versasec's perspective on scaling credential management for passwordless identity

Context

Passwordless credential strategy is not just an authentication change. It is an identity governance problem that spans issuance, lifecycle control, reporting, and auditability across credentials such as smart cards, virtual smart cards, and software certificates. When those controls do not scale, security teams end up modernising the login experience while leaving governance gaps intact.

This interview uses Versasec’s leadership perspective to describe how a credential platform matures from startup concept to enterprise infrastructure. The useful takeaway for IAM and security leaders is not the business narrative itself, but the reminder that scalable identity programmes depend on operational discipline long before they depend on expansion or market validation.

Key questions

Q: How should organisations govern passwordless credentials at enterprise scale?

A: Treat passwordless credentials as governed identity assets, not convenience features. The programme should define issuance, renewal, revocation, exception handling, and evidence retention for every credential type in scope. If those controls are unclear, passwordless adoption can reduce password risk while creating new lifecycle and audit blind spots.

Q: Why do Zero Trust programmes still depend on credential management?

A: Zero Trust depends on continuous verification, and verification is only as strong as the credential lifecycle behind it. If credentials are issued too broadly, linger too long, or lack clear removal processes, the trust boundary shifts from policy to stale access. Credential governance is therefore a core Zero Trust dependency, not an optional support function.

Q: What do IAM teams get wrong about passwordless migration?

A: They often focus on login replacement and underinvest in the operational model behind it. Passwordless migration still requires ownership, audit evidence, recovery paths, and coordination with broader identity controls. Without those elements, the organisation modernises authentication without fixing governance.

Q: How can security teams tell whether credential governance is mature enough?

A: Look for measurable controls, not claims of modernisation. Mature governance can show where credentials are issued, who owns them, how they are revoked, and whether those actions are visible to audit and compliance stakeholders. If the programme cannot produce that evidence, it is not yet operating as a governed identity system.

Technical breakdown

Credential lifecycle control in passwordless programmes

Passwordless authentication changes the primary credential type, but it does not remove credential management. Smart cards, virtual smart cards, and software-based certificates still need issuance, renewal, revocation, and audit trails. The operational risk shifts from password theft to lifecycle failure, where credentials remain valid longer than intended or are not governed consistently across environments. In practice, passwordless only reduces one class of exposure if identity teams can keep the credential lifecycle controlled end to end.

Practical implication: treat passwordless as a lifecycle programme, not just an authentication upgrade.

Why Zero Trust depends on credential governance

Zero Trust architecture assumes access is continuously verified and limited to what is needed now. That model breaks if credential issuance and recovery are weak, because the trust boundary becomes the credential itself. For enterprise credential platforms, the important question is not whether they support modern authentication formats, but whether they can enforce traceable, policy-driven control over who receives credentials, how they are used, and how they are removed.

Practical implication: align credential systems with Zero Trust policy rather than bolting them on after deployment.

Scaling identity operations across audit and reporting demands

As organisations mature, identity tooling has to satisfy more than technical access needs. Financial reporting discipline, audit evidence, and certification requirements become part of the operating model. That means credential governance must produce evidence that stands up to internal controls, external auditors, and certification authorities. A platform that cannot support measurable administration is not ready for broad enterprise use, regardless of how strong its authentication story sounds.

Practical implication: verify that credential operations generate audit-ready evidence before expanding rollout.

NHI Mgmt Group analysis

Credential management is the real control plane behind passwordless identity. Replacing passwords only changes the front door if issuance, renewal, and revocation remain governed. The article makes clear that credentials still exist in multiple forms, and that operational maturity is what turns a passwordless idea into an enterprise control surface. Practitioners should treat credential lifecycle design as the primary security decision, not a back-office function.

Scaling identity programmes requires measurable administration, not just authentication UX. The chairman’s emphasis on disciplined financial reporting maps directly to identity governance: if the programme cannot be measured, it cannot be steered. That same logic applies to credential inventory, certificate validity, and revocation completeness. Practitioners should expect the identity platform to produce evidence that can survive scrutiny from auditors and certification bodies.

Zero Trust becomes fragile when credential governance is fragmented. The platform story points to a familiar failure mode in enterprise IAM, where access policy is modern but credential administration is still scattered. Passwordless and certificate-based authentication only support Zero Trust if lifecycle control is consistent across issuance channels and environments. Practitioners should view fragmented credential administration as a direct threat to policy enforcement.

Credential strategy is now a programme-level governance issue, not a product feature. The interview shows how leadership, operations, and market readiness all converge around the same foundation: control over digital credentials. That is why identity teams cannot separate authentication planning from lifecycle governance, audit readiness, and operational reporting. Practitioners should align credential strategy with broader IAM and PAM governance, not a single deployment track.

From our research:

• DeepSeek accidentally embedded over 11,000 secrets in its training data and left a database exposed online, revealing more than one million sensitive records including chat histories, backend credentials, and API keys, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• From our research: The average estimated time to remediate a leaked secret is 27 days, according to The State of Secrets in AppSec.

What this signals

Credential programmes are now judged by recoverability, not just issuance quality. If a platform can create credentials faster than teams can revoke and evidence them, passwordless becomes a governance liability. The programme should be designed around lifecycle visibility, especially where certificates and smart cards are being used as part of Zero Trust.

Operational discipline is the differentiator between modern identity and managed identity debt. The interview reinforces a core identity truth: growth without measurement creates blind spots. For teams running credential systems, that means ownership, reporting, and audit evidence need to be designed into the operating model, not added after deployment.

For teams aligning credential strategy with broader identity controls, the useful next step is to benchmark governance against established control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls. The relevant test is whether issuance, revocation, and audit evidence are consistently enforceable across all credential classes, not whether the platform simply supports modern authentication formats.

For practitioners

• Map every credential type in scope Inventory smart cards, virtual smart cards, and software certificates separately so issuance and revocation rules match the actual credential class. Use the inventory to expose gaps in ownership, renewal timing, and emergency removal paths.
• Tie passwordless rollout to lifecycle controls Require issuance, renewal, and revocation workflows to be defined before expanding passwordless use. The rollout should include exception handling for lost credentials, inactive users, and administrative recovery.
• Validate audit evidence early Check that the credential platform can produce records suitable for internal audit, external certification, and compliance review. Evidence should show who issued what, when it expires, and how removal is verified.

Key takeaways

• Passwordless authentication still depends on credential lifecycle control, so governance does not disappear when passwords do.
• Enterprise scaling requires measurable identity operations, including audit-ready reporting and clear credential ownership.
• Zero Trust and passwordless programmes fail when credential administration is fragmented or lacks end-to-end revocation control.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords from the primary login flow and replaces them with stronger credentials such as certificates, smart cards, or device-bound factors. The security value depends on whether those credentials are issued, protected, and revoked with the same discipline as any other identity asset.
• Credential Lifecycle: The full path of a credential from issuance through use, renewal, suspension, and revocation. In enterprise identity programmes, lifecycle control is the difference between a governed credential and a lingering access risk, especially when multiple credential forms are used across human and machine workflows.
• Zero Trust Architecture: A security model that requires continuous verification rather than assuming trust after initial authentication. For credentials, this means access should remain limited, observable, and revocable throughout the session, with policy enforcement that does not depend on static trust in the credential itself.

What's in the full article

Versasec's full post covers the leadership and product context this analysis intentionally leaves for the source:

• The interview’s full discussion of how the chairman approached company scaling, investor confidence, and operational discipline
• Versasec’s description of vSEC:CMS as a credential management system for issuing, managing, and controlling digital credentials
• The product framing around vSEC:CLOUD deployment in a virtual private cloud with customer separation
• The company’s own explanation of how its credential management approach supports phishing-resistant MFA and Zero Trust

👉 Versasec's full post adds the leadership interview, product context, and platform positioning behind the credential strategy discussion.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.