Passwordless authentication challenges expose identity sprawl risk

At a glance

What this is: This is Axiad's analysis of why passwordless authentication efforts stall, with credential sprawl, platform fragmentation, and weak deprovisioning emerging as the core governance problems.

Why it matters: It matters because IAM teams cannot treat password removal as the finish line when credentials, devices, and machine access still need one governed lifecycle across the estate.

By the numbers:

• Employees frequently have more than 190 different passwords to log into the applications and systems they use every day.
• 10% or more of employees can access their former employer’s data after leaving.

Context

Passwordless authentication removes shared secrets from the user experience, but it does not remove the underlying identity governance burden. The challenge shifts to managing credential issuance, renewal, revocation, and platform consistency across humans, machines, and devices.

Axiad's article argues that passwordless programmes often fail when organisations try to layer new methods on top of legacy IAM sprawl. The practical question is not whether passwords disappear, but whether identity lifecycle control becomes simpler or more fragmented after they do.

Key questions

Q: What fails when passwordless authentication is added to a fragmented IAM estate?

A: Credential management fails first. Passwordless still depends on issuance, renewal, recovery, and revocation, and those controls become inconsistent when identities are spread across multiple systems. The result is more complexity for IT and more confusion for users, which means passwordless adoption can modernise login without fixing the underlying access lifecycle.

Q: Why do passwordless programmes still need strong help desk controls?

A: Passwordless programmes still need strong help desk controls because recovery workflows often become the easiest way to defeat authentication. If a help desk can reset access or re-enrol a device without robust verification, the attacker does not need to break the login method. The help desk becomes a privileged identity gateway that must be governed like one.

Q: How do you know whether passwordless is actually reducing identity risk?

A: Look for fewer reusable secrets, lower help-desk volume for credential resets, and clear evidence that fallback access is rare and well documented. If recovery requests are increasing or break-glass use is common, the programme may be shifting risk rather than removing it. Audit data should confirm that assurance is improving.

Q: Should organisations prioritise passwordless adoption or credential consolidation first?

A: Credential consolidation should come first when identities are already spread across several IAM systems. Passwordless reduces dependence on passwords, but it cannot remove the administrative burden of fragmented renewal, recovery, and offboarding. A single governance model makes the passwordless transition safer and easier to support at scale.

Technical breakdown

Why passwordless hits credential sprawl

Passwordless authentication changes the authentication method, not the number of identities, systems, or trust relationships that have to be governed. If a workforce is already spread across multiple IAM platforms, each with its own enrollment, renewal, and recovery flow, passwordless simply adds another control surface. The operational burden moves from remembering passwords to coordinating authenticator enrollment, device binding, and recovery across disparate systems. That is why the authentication layer can look modern while the governance layer remains brittle.

Practical implication: consolidate credential workflows before expanding passwordless beyond isolated pilot groups.

Why offboarding remains the hard control

Deprovisioning is the most important governance test in passwordless programmes because the control value depends on whether access actually disappears when employment ends. The article’s risk example is straightforward: slow or incomplete offboarding leaves former employees able to reach sensitive data long after departure. In practice, passwordless does not eliminate this issue because the problem sits in account lifecycle management, not password mechanics. If revocation does not propagate cleanly across every platform, residual access remains even when the user no longer needs it.

Practical implication: map passwordless rollout to account revocation and access removal workflows, not just login modernisation.

What passwordless orchestration changes for users and IT

The article’s passwordless orchestration idea is really about reducing fragmentation. A single management layer can make renewal, reset, and authentication less confusing for users while lowering help desk load for IT. That matters because passwordless adoption often fails at the point where end users have to manage multiple enrollment and recovery processes. The technical issue is not only convenience. It is whether one governed platform can become the authoritative place where credentials for people, machines, and devices are issued and maintained.

Practical implication: define one authoritative workflow for enrollment, renewal, and reset before scaling passwordless across the enterprise.

Threat narrative

Attacker objective: The attacker objective is to retain or exploit access that should have been revoked, then use it to reach sensitive organizational data after the user relationship has ended.

1. Entry occurs through identity sprawl, where credentials are distributed across multiple IAM systems and are hard to govern consistently.
2. Escalation follows when deprovisioning is slow or incomplete, leaving former users with lingering access after departure.
3. Impact is residual access to sensitive data, including intellectual property, customer information, and business documents.

Breaches seen in the wild

• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwordless does not reduce identity governance complexity by itself: It changes the authentication method, but the organisation still has to govern lifecycle, renewal, recovery, and offboarding across many systems. If the underlying IAM estate is fragmented, passwordless can simply relocate the sprawl instead of removing it. The real measure is whether identity control becomes more centralised and auditable, not whether passwords disappear.

Identity sprawl is the named failure mode behind failed passwordless programmes: The article shows that passwordless initiatives stall when credentials, platforms, and user workflows remain distributed across too many systems. That is not a user-experience problem alone. It is a governance design problem, because fragmented issuance and revocation create inconsistent access state across humans, machines, and devices. Practitioners should treat sprawl as the core control gap, not a side effect.

Passwordless adoption exposes lifecycle control debt: Renewal and offboarding are the two moments where weak governance becomes visible, because they reveal whether credentials can be changed or removed everywhere they exist. The article’s deprovisioning risk is the clearest example: if a former employee can still access data, the lifecycle process failed. The discipline has to shift from authentication modernisation to access state control.

Consolidation is the operational prerequisite for durable passwordless: A single passwordless platform can simplify the user journey only when it also standardises how identities are issued, maintained, and revoked. That makes the debate less about login method and more about lifecycle authority. Organisations that do not unify credential governance will struggle to make passwordless stick beyond pilot scope.

Credential governance without platform consolidation: Passwordless programmes inherit the same fragmentation they were meant to remove when identity methods are layered onto multiple IAM systems. The implication is not that passwordless fails, but that its success depends on reducing the number of places where identity state can diverge. Practitioners should treat centralised credential governance as the prerequisite control, not the afterthought.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Identity sprawl is the real blocker to passwordless maturity: Organisations that treat password removal as the goal often miss the harder work of consolidating issuance, recovery, and revocation across the identity estate. Passwordless becomes durable only when it is supported by a single governed lifecycle for users, machines, and devices.

A practical passwordless programme should be judged by whether it shrinks the number of places identity state can diverge. If users still jump across multiple IAM platforms or IT still cleans up stale access manually, the security benefit remains partial.

The strongest signal of progress is not fewer passwords alone. It is whether access can be renewed and removed consistently without creating new administrative exceptions.

For practitioners

• Centralise credential governance Create one governed place for credential issuance, renewal, reset, and revocation so passwordless methods do not multiply control paths across platforms.
• Tie passwordless rollout to offboarding Require every passwordless workflow to prove that deprovisioning removes access across all systems before the user account is closed.
• Inventory user, machine, and device authenticators Map which identities are still authenticated through legacy passwords, FIDO, OTP, PKO, or other methods so you can remove inconsistent paths.
• Reduce help desk dependence for credential recovery Build self-service reset and recovery flows so lost or expired authenticators do not force manual intervention for every exception.

Key takeaways

• Passwordless authentication does not eliminate identity governance work, because the underlying problem is credential sprawl across systems and lifecycle steps.
• The article shows that employees may hold more than 190 passwords and that 10% or more can retain access after departure, which makes offboarding a measurable risk point.
• Organisations need consolidated credential control, not just new login methods, if passwordless is going to improve security rather than add fragmentation.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Credential Lifecycle: Credential lifecycle is the process of issuing, rotating, expiring, and revoking secrets, certificates, and tokens across their usable life. For non-human identities, lifecycle discipline is the core control that separates temporary access from persistent exposure.
• Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.