Hybrid passwordless authentication raises the bar for identity security

At a glance

What this is: RSA Security describes how a major US bank applied hybrid passwordless authentication to support mixed device and user populations while retaining access to legacy applications and tightening credential protection.

Why it matters: IAM teams should treat passwordless as a hybrid access and governance problem, not just a login change, because third parties, BYOD, and legacy systems expand the control boundary.

Context

Hybrid passwordless authentication removes passwords from the primary sign-in path, but it does not remove identity risk. The hard part is governing access across managed endpoints, personal devices, remote users, third parties, and legacy applications at the same time.

This case is about an IAM programme in a regulated financial environment, where uptime, device trust, and compliance are tightly coupled. The article frames passwordless as part of broader identity security, not a standalone authentication upgrade.

The starting position here is atypical in scale and regulatory pressure, but the underlying governance problem is common across large hybrid estates.

Key questions

Q: How should security teams implement hybrid passwordless authentication across legacy and modern systems?

A: They should treat it as an access-architecture programme, not a single authentication setting. That means mapping every application and user population, defining fallback paths for legacy systems, and ensuring policy consistency across cloud, on-premises, remote, third-party, and BYOD access.

Q: What do organisations get wrong about passwordless rollout in hybrid environments?

A: They often focus on the sign-in method and ignore the surrounding controls. Recovery, support, break-glass access, and exception handling can recreate the same risk the passwordless programme was meant to remove. Hybrid estates need policy consistency, not just a modern login screen on selected platforms.

Q: What breaks when authentication stops at login?

A: Login-only controls can confirm who entered, but they cannot prove the same identity still controls the session after access is granted. That creates exposure to session hijacking, shared credentials, and insider misuse. Continuous authentication closes that gap by evaluating behavior and context throughout the session rather than relying on a single entry event.

Q: What is the difference between passwordless and stronger identity governance?

A: Passwordless changes how users authenticate, but it does not by itself govern who should have access, when access should be removed, or how exceptions are managed. Strong identity governance covers entitlement lifecycle, policy enforcement, and continuous visibility. In practice, passwordless is one control inside a broader governance model.

Technical breakdown

Hybrid passwordless authentication across managed and BYOD devices

Hybrid passwordless authentication replaces reusable passwords with passkeys and other strong authenticators, but the architecture still has to bind the identity flow to device state, user context, and policy. In mixed environments, that means the authentication layer must work across Windows, Mac, remote access, third parties, and personal devices without forcing separate control paths that weaken assurance. The security value comes from reducing password reuse and phishing exposure while preserving consistent policy enforcement across disparate endpoints.

Practical implication: define the same authentication assurance target for every access path, then verify that the control behaves consistently on managed and personal devices.

Legacy application access in a passwordless model

Legacy on-premises applications often depend on authentication patterns that predate passkeys, federation maturity, or device-aware policy. A hybrid passwordless design therefore has to bridge modern identity controls to older systems without creating bypasses, fallback credentials, or exception sprawl. That bridge is the real design challenge, because passwordless at the front door does not help if downstream applications still accept weaker paths or cached trust.

Practical implication: inventory every legacy application authentication path and identify where fallback access or exception handling could reintroduce password risk.

Risk-based authentication and credential protection

Risk-based authentication adds context to the decision, such as device trust, anomaly signals, and suspected compromise, so that access can be stepped up or constrained when conditions change. In hybrid estates, that is especially important for BYOD and third-party access, where the device cannot be assumed clean or fully managed. The article’s mobile protection angle shows that passwordless assurance must extend beyond the initial login event to the integrity of the credential use environment.

Practical implication: pair passwordless rollout with risk scoring and device-based credential protection for sessions that originate on less trusted endpoints.

Threat narrative

Attacker objective: The attacker aims to gain unauthorized access to regulated banking resources by exploiting weaker identity paths, compromised devices, or legacy authentication gaps.

1. Entry begins with authentication to hybrid systems through managed, remote, third-party, or BYOD access paths rather than through a traditional password spray model.
2. Credential abuse occurs when weak or reused credentials, or compromised devices, make identity compromise easier across a mixed environment.
3. Impact follows when unauthorized access reaches regulated systems, legacy applications, or sensitive banking workflows that were never designed for uniform modern authentication.
4. The attacker objective is to steal or misuse credentials in a way that bypasses identity controls and exposes sensitive financial access paths.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid passwordless is an identity governance problem, not just an authentication project. The bank’s use case spans managed endpoints, remote work, third parties, BYOD, and legacy applications, which means the control boundary is the full access lifecycle rather than a single login screen. That is where most programmes fail: they modernise the front door but leave inconsistent policy behind it. The practitioner conclusion is that passwordless only counts when the whole access path is governed.

Legacy coverage determines whether passwordless reduces risk or simply relocates it. If older applications still require fallback credentials or inconsistent federation paths, the organisation has not removed password dependence. It has preserved it in exception handling. The implication is that hybrid passwordless must be judged by the weakest connected system, not by the modern authentication stack alone.

Device-aware identity controls are now part of the access decision. A passwordless model on BYOD or compromised devices still needs contextual enforcement because the credential is only one part of the trust decision. This shifts identity security toward session and device integrity, where authentication strength and endpoint condition have to be evaluated together. Practitioners should treat device state as a first-class input to identity governance.

Identity blast radius becomes the right metric for hybrid environments. The article shows that third parties, remote workers, and personal devices can all expand the scope of a single identity decision. The governance question is no longer whether passwordless works, but how far a compromised identity can travel when access spans cloud, on-premises, and mobile endpoints. Teams should assess blast radius, not just login experience.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
• Read next: NHI Lifecycle Management Guide

What this signals

Hybrid passwordless only changes the risk picture when the fallback estate is controlled. Teams that leave legacy authentication, contractor exceptions, and device exceptions untouched will simply move pressure from passwords to exception handling. The practical signal is whether access policy remains consistent once the user leaves the modern sign-in path.

Third-party access is where hybrid passwordless often expands governance scope fastest. According to the Ultimate Guide to NHIs, 92% of organisations expose NHIs to third parties, raising concerns about supply chain security. Even when this article is about human access, the same lesson applies: external trust chains need tighter lifecycle control than internal users do.

For practitioners

• Map every password fallback path Identify legacy applications, break-glass access, and exception processes that still depend on passwords, cached credentials, or one-off workarounds.
• Extend device trust into authentication policy Require device posture, managed status, and mobile protection signals before allowing passwordless access from BYOD and remote endpoints.
• Separate third-party access from internal trust assumptions Apply distinct policy, monitoring, and revocation processes to contractor and supplier identities rather than inheriting employee access patterns.
• Test authentication against regulated downtime scenarios Validate that passwordless and federation controls still work during identity provider outages, legacy system failures, and compliance-driven recovery events.

Key takeaways

• Hybrid passwordless reduces reliance on reusable credentials, but it does not remove the need to govern legacy paths, third parties, and device trust.
• The article’s central lesson is that authentication strength only matters when the surrounding access architecture is consistent across cloud, on-premises, and BYOD environments.
• Identity teams should measure passwordless by the weakest connected system, because that is where the residual risk remains.

Key terms

• Hybrid Passwordless Authentication: An access model that replaces passwords with stronger authenticators while still supporting mixed environments such as legacy applications, remote workers, and third-party access. In practice, it must coordinate federation, recovery, and device trust so the new login method does not reintroduce weaker fallback paths.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Device Trust: Device trust is the confidence that a requesting endpoint is known, managed, and in a compliant state. It matters because identity alone does not prove safety. In zero trust programmes, device trust becomes one of the inputs used to decide whether access should be granted or sustained.
• Fallback authentication: Fallback authentication is the secondary method used when the primary sign-in factor is unavailable. For passkey deployments, fallback must be tightly governed because it often becomes the attacker’s preferred route if it remains easier to abuse than the main login path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.