Identity-first security is becoming the baseline for remote work

At a glance

What this is: This is Axiad’s analysis of remote work as an identity security problem, arguing that identity-first security has become the practical baseline because remote work expanded credential exposure, phishing, malware, and policy bypass pressure.

Why it matters: It matters because IAM teams have to design controls for usability as well as assurance, or employees will route around friction and expand risk across human, machine, and cloud access paths.

By the numbers:

• remote work was around 5% before the pandemic and rose to 60% by spring 2020, according to The Economist cited by Axiad.
• Axiad’s Remote Work Survey found that phishing threats affected 71% of respondents.
• Axiad’s Remote Work Survey found that malware affected 61% of respondents.
• More than half, or 52%, of tech leaders said remote employees found workarounds to company security policies.

Context

Identity-first security is the idea that access, authentication, and credential governance sit at the centre of how work gets done. In this article, Axiad argues that remote work turned that from a design preference into a baseline operating condition for modern enterprises.

The security gap is not just stronger authentication. It is the friction gap between policy intent and how employees actually work when they are outside the office perimeter, using more devices, more applications, and more credentials than before.

For IAM teams, the issue spans human identity and non-human identity together: users need manageable authentication, while the growing number of applications and devices also expands the credential estate that has to be issued, tracked, and governed.

Key questions

Q: How should organisations roll out multi-factor authentication for remote workers without creating friction that drives workarounds?

A: Start with the highest risk access paths, then expand MFA coverage in phases. Prioritise privileged users, remote access, and systems exposed outside the traditional perimeter. Pair rollout with user education and a clear help path, because complexity and poor experience are common adoption blockers. Stronger controls stick better when they are easy to use and tied to the actual risk profile.

Q: Why do remote employees create more identity risk than office-based users?

A: Remote employees often authenticate from less controlled devices and networks, then depend on cloud and SaaS access that may be broader than their day-to-day task set. That combination increases the chance that phishing, malware, or a weak workaround becomes an enterprise access event. The risk comes from distributed trust, not remote work alone.

Q: What are the signs that remote access controls are not working as intended?

A: Warning signs include vulnerable endpoints, misconfigured remote access systems, users reaching sensitive data they do not need, and audit findings that show policies are not being followed. Repeated incidents, weak password enforcement, and poor response to anomalies also indicate control failure. If access cannot be verified, reviewed, and constrained centrally, the remote access programme is probably drifting outside its intended security boundary.

Q: How can IAM teams support remote work without weakening access control?

A: Use identity as the primary control plane, with access decisions driven by role, business need, and risk rather than physical location. That lets teams support distributed work while keeping approvals auditable and consistent across systems and geographies.

Technical breakdown

Why remote work increases authentication complexity

Remote work removes the traditional assumption that access happens inside a controlled office environment. That shift increases the number of devices, applications, and authentication paths an organisation must support, which in turn multiplies credential issuance, tracking, and revocation workload. The article points out that organisations added new credential types quickly, including for collaboration tools and personal devices brought into corporate use. The technical issue is not only scale but heterogeneity: one user may need several trust anchors across endpoints, apps, and remote access flows.

Practical implication: identity teams need to treat remote access as a credential estate problem, not a single sign-on problem.

Why usability determines whether identity controls are followed

The article’s key operational point is that remote workers will work around security controls that are too hard to use. That is an identity governance failure, because policy only exists in practice if users can complete work without creating exceptions. When authentication becomes friction-heavy, employees seek shortcuts, which weakens assurance and makes security controls advisory rather than enforced. This is especially important where multiple authenticators, device checks, and off-network workflows all have to coexist without creating confusion.

Practical implication: measure authentication friction as a security control signal, not just a user-experience metric.

Credential management becomes a lifecycle discipline

As remote work expands, credential governance shifts from a narrow provisioning task to a full lifecycle discipline. The article notes the time and resource cost of deploying, tracking, onboarding, and offboarding credentials as employees move in and out of roles or devices. That places stronger demands on issuance, inventory, and revocation discipline across human access and machine-authenticated applications. In practice, the challenge is maintaining trust continuity without letting credentials accumulate beyond their intended scope or lifetime.

Practical implication: align credential issuance, inventory, and offboarding to the same lifecycle controls you apply to other identity assets.

Threat narrative

Attacker objective: The attacker aims to exploit remote-work authentication sprawl and user friction to gain access through weaker identity controls and bypassed policy paths.

1. Entry occurs through remote work expansion, where users and devices operate outside a central office control plane and rely on more authentication points than before.
2. Credential and control pressure rises as organisations issue more account types and security policies become harder for employees to follow consistently.
3. Impact comes when phishing, malware, and policy workarounds reduce the reliability of the identity layer that remote productivity depends on.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity-first security becomes mandatory when work moves outside the perimeter: The article shows that remote work did not merely increase remote access demand. It changed the operating assumption behind enterprise authentication, because access is now distributed across devices, locations, and applications. For identity governance, that means the control point has shifted from network location to credential quality, issuance discipline, and user adoption.

Authentication friction is a governance failure, not just a usability issue: When employees find workarounds, the organisation has lost enforcement even if the policy still exists on paper. That is especially true in remote environments where business continuity depends on fast, low-friction access. The practical conclusion is that policy design and actual user behaviour have to be governed together.

Remote work exposes the full credential lifecycle, not just login security: This article is really about how many identities now have to be created, tracked, and retired to keep work moving. The more credential types an organisation introduces, the more lifecycle discipline matters across onboarding, device enrolment, and offboarding. Teams should treat credential sprawl as an identity programme issue, not an endpoint-side inconvenience.

Hybrid identity governance now has to cover human and machine access in the same operating model: The article notes both employee credentials and the growing number of machine identities and applications needed for remote work. That convergence means access governance can no longer be split between user-facing convenience and backend technical control. Practitioners need a single governance view of who or what is authenticating, why, and for how long.

Identity attack surface is now a business continuity variable: The combination of phishing, malware, and policy workarounds shows that remote work security breaks when identity controls become harder to follow than the work itself. In practice, the identity layer is no longer a front-end gate. It is a core operational dependency, and programme owners need to measure whether controls remain usable under real work pressure.

What this signals

Identity-first security is now an operating model, not a slogan: Remote work removed the office as the default trust boundary, so access governance now has to assume distributed users, multiple devices, and higher authentication variability. That makes identity architecture a core resilience concern for IAM, PAM, and access governance teams.

Credential simplicity is now part of control effectiveness: If employees cannot complete their work through approved authentication flows, they will create exceptions. In practice, that means the success of identity policy depends on whether the approved path is the easiest compliant path.

Remote work has expanded the identity attack surface across human and machine access: The growth in collaboration tools, personal devices, and application credentials means identity teams need to govern more than user logins. They need a programme view of issuance, inventory, and revocation across the full credential estate.

For practitioners

• Standardise authentication paths Reduce the number of credential types each workforce segment must manage, and make the primary path simple enough that users do not need informal workarounds to stay productive.
• Track policy workarounds as a security signal Feed reports of user bypasses, shadow access habits, and exception requests into identity governance reviews so friction patterns are visible before they become normal behaviour.
• Rationalise the credential estate Map which applications, devices, and remote access methods create separate authenticator demands, then remove redundant credential flows where they do not add assurance.
• Align onboarding and offboarding with remote access reality Review whether remote workers and their devices are fully enrolled, tracked, and revoked with the same discipline as office-based users and centrally managed endpoints.

Key takeaways

• Remote work changed identity from a supporting control into the main security boundary for many enterprises.
• The article shows that user friction, not just threat volume, drives policy bypass and weakens assurance.
• IAM teams need to govern credential lifecycle, usability, and access consistency together if remote work is to remain secure.

Key terms

• Identity-first security: Identity-first security is an approach that treats identity as the primary control plane for managing risk. Instead of relying mainly on network or endpoint boundaries, it uses identity context to decide what can happen, when it can happen, and under what conditions. That model is especially relevant where privileges move across human, non-human, and agentic actors.
• Credential Estate: A credential estate is the full set of tokens, keys, certificates, and other authenticators an organisation uses across systems and workflows. It matters because compromise is rarely limited to one secret. Weak inventory, rotation, or ownership turns the estate into a reusable attack surface.
• Authentication Friction: The delay, confusion, and support burden created when users cannot complete sign-in cleanly. In IAM programmes, friction is a governance signal because it drives resets, exceptions, and workarounds. If users routinely hit the recovery path, the authentication design is not yet operationally stable.
• Policy workaround: Any user action that bypasses the approved identity process in order to complete work faster. Workarounds often appear when controls are too slow or confusing, and they are a strong signal that usability and governance are out of balance in the access model.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.