TL;DR: Passwordless authentication in 2026 only works when cryptographic credentials are bound to a verified human identity, because FIDO2 alone does not prevent insecure enrollment or impersonation, according to 1Kosmos. The governance test has shifted from password removal to whether identity proofing, phishing resistance, and hardware-backed verification are integrated end to end.
At a glance
What this is: This is an analysis of passwordless authentication in 2026 that argues the real control boundary is verified identity, not password removal alone.
Why it matters: It matters because IAM teams need phishing-resistant authentication that also closes enrollment and impersonation gaps across workforce and customer identity programmes.
Context
Passwordless authentication now sits at the intersection of human identity proofing and authentication assurance. Removing passwords does not automatically remove phishing, MFA fatigue, or account takeover risk if the credential is not bound to a verified person.
In practice, the governance problem is no longer whether a login is password-free. It is whether the organisation can prove that the credential was issued to the right individual, through the right enrolment path, and with sufficient assurance for the risk of the application.
That makes passwordless a human IAM control issue as much as an authentication method choice. The article’s core argument is that weak enrolment turns passwordless into a new trust gap rather than a security upgrade.
Key questions
Q: How should security teams stop passwordless enrolment from becoming an impersonation path?
A: Treat enrolment as the highest-risk step in the passwordless lifecycle. Require strong identity proofing, verify the presence of the genuine user at issuance, and do not issue credentials until the enrolment record can be trusted. If the onboarding flow is weak, the login method can still be secure while the identity behind it is fraudulent.
A: Security teams should deploy FIDO2 where phishing resistance and user experience both matter, especially for workforce or customer accounts that face password abuse. The core design is public key cryptography, where the private key stays on the user’s device or security key and only a signed challenge is verified by the service. That eliminates password reuse and makes stolen credentials far less useful.
Q: What are the signs that a passwordless programme is too weak to trust?
A: Watch for enrolment flows that rely on self-asserted identity, inconsistent proofing across user populations, or separate systems for verification and authentication. Those seams make it easy for an attacker to impersonate a user before the first login ever happens.
A: They should raise assurance when the action has material financial, operational, or regulatory impact, such as funds movement, privileged access, or sensitive data approval. The right threshold depends on business risk, not convenience. A stronger workflow for high value transactions helps prevent identity deception while allowing lighter checks for low risk tasks.
Technical breakdown
Why verified enrolment is the real control boundary
Passwordless authentication uses cryptographic keys, but the security outcome depends on who receives the credential in the first place. If identity proofing is weak, an attacker can enrol a fraudulent identity and then authenticate perfectly with a valid key. That is why the binding point matters: the cryptography protects the session, but enrolment protects the identity record behind it. In human IAM terms, the problem shifts from password entropy to proofing assurance, device possession, and the integrity of the issuance process. Practical implication: treat enrolment as part of the authentication control, not as a separate onboarding step.
Practical implication: govern enrolment with the same assurance expectations as the login flow itself.
Why FIDO2 is phishing-resistant but not identity-proofing by itself
FIDO2 prevents a credential from being replayed on a fraudulent domain because the authenticator signs a challenge for the real relying party. That blocks classic phishing and credential stuffing, but it does not prove the person enrolling the key is genuine. In other words, domain binding stops interception, while identity proofing stops impersonation. The strongest passwordless programmes combine both because phishing resistance and enrolment assurance solve different failures. Practical implication: do not treat FIDO2 adoption as the finish line if the onboarding path still trusts unverified users.
Practical implication: pair phishing-resistant authentication with proofing controls that validate the enrollee before issuance.
How biometrics and hardware-backed checks change assurance
Biometric or hardware-backed checks do not replace identity verification. They increase assurance that the enrolled user is physically present and using the registered device, which reduces replay and remote social engineering. The control value comes from chaining the checks: verify the identity first, issue the credential second, and then require a local presence factor at login. Without that sequence, biometrics become a convenience layer rather than an assurance layer. Practical implication: design passwordless flows so that device binding and presence verification reinforce, rather than substitute for, identity proofing.
Practical implication: use local presence checks to strengthen a verified identity, not to compensate for weak proofing.
Threat narrative
Attacker objective: The attacker wants a valid passwordless credential issued to the wrong person so they can persistently bypass login controls.
- Entry occurs when an attacker uses phishing, stolen personal data, or social engineering to reach a weak passwordless enrolment flow.
- Credential access follows when the attacker is issued a legitimate cryptographic authenticator tied to an unverified or impersonated identity.
- Impact is achieved when that credential is used for repeated phishing-resistant logins, turning a flawed onboarding event into durable account takeover.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Verified identity, not password removal, is the true control objective: Passwordless authentication only improves security when the credential is tied to a real person at issuance time. Without that binding, the organisation has simply moved the trust gap from the password field to the enrolment workflow. The practitioner conclusion is that verification must be treated as part of the authentication architecture, not a separate onboarding formality.
Phishing resistance and enrolment assurance solve different problems: FIDO2 protects the login transaction, while identity proofing protects the lifecycle event that creates the credential. Those two controls are complementary, not interchangeable. The governance mistake is to count a strong authenticator as proof that the identity behind it was ever validated.
Asynchronous onboarding breaks human IAM assumptions: Human enrolment controls were designed for workflows where identity, device, and access review could be anchored to a stable user record. That assumption weakens when the issuance path accepts weak proofing, outsourced verification, or inconsistent step-up checks. The implication is that access governance must move upstream into credential issuance, because post-login review cannot repair a bad enrolment decision.
Identity proofing becomes the differentiator in passwordless programmes: Once passwords disappear, the quality of the identity proofing layer determines whether the programme reduces fraud or just changes its shape. Organisations that separate authentication from enrolment create seams attackers can exploit. Practitioners should evaluate passwordless tools by the strength of the enrolment chain, not by whether they support passkeys or FIDO2 alone.
Human-use cases and regulated environments need end-to-end assurance: Workforce, customer, and frontline identity journeys all fail differently, but they share one requirement: the system must know who is being issued the credential. That makes verified identity a governance control with fraud, support, and compliance implications. Teams should align assurance levels to the sensitivity of the application and the risk of impersonation.
What this signals
Verified identity is the missing layer in many passwordless rollouts: Organisations that celebrate password elimination before they harden enrolment are moving risk, not removing it. The governance challenge is to make credential issuance as trustworthy as the login ceremony, because attackers increasingly target the moment identity is first bound to the authenticator.
Passwordless controls will keep splitting into two classes: methods that are merely phishing-resistant at login, and methods that also govern who gets issued the credential. The latter changes how IAM, fraud prevention, and support teams share accountability for identity assurance.
For practitioners
- Bind enrolment to verified identity Require government-issued ID checks, liveness verification, and enrolment approval before issuing passwordless credentials for sensitive applications.
- Separate phishing resistance from proofing assurance Test whether your passkey or FIDO2 rollout still depends on unverified onboarding, because domain binding does not correct weak identity proofing.
- Raise assurance for regulated workflows Apply higher enrolment scrutiny to finance, healthcare, government, and other high-risk use cases where impersonation has material impact.
- Review the issuance path before scaling Map every step from account creation to credential issuance so you can identify where an attacker could present a false identity and still receive a valid authenticator.
Key takeaways
- Passwordless authentication is only as strong as the identity proofing that sits behind credential issuance, not the strength of the login protocol alone.
- FIDO2 blocks many phishing tactics, but it does not stop weak enrolment from issuing a valid credential to the wrong person.
- IAM teams should evaluate passwordless platforms on end-to-end assurance, including verification, enrolment, and presence checks.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | The article centres on verified identity at enrolment before passwordless credentials are issued. |
| SP 800-63B — Authentication | Passwordless authentication quality depends on phishing-resistant authenticator handling at login. | |
| Recommendation — Apply SP 800-63A to strengthen proofing before issuing passwordless credentials. Use SP 800-63B to require phishing-resistant authentication for sensitive access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on who receives access and whether the authenticator is bound to the right identity. |
| Recommendation — Apply PR.AA-05 to align access issuance with verified identity and least-risk enrolment. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Weak enrolment creates authentication failures even when the login method is cryptographically strong. |
| Recommendation — Use API2-style authentication checks to ensure issued credentials cannot be abused through weak identity binding. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account creation and provisioning quality determine whether passwordless identities are trustworthy. |
| Recommendation — Apply CIS-5 to govern account issuance, verification, and lifecycle controls for passwordless users. | ||
Key terms
- Verified identity: Verified identity is an access model where the person or account behind a session is strongly proven before permission is granted. In MedTech, that usually means binding authentication to a specific device and trusted credential source so login can support operational risk decisions.
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Credential issuance: The process of creating, enrolling, and binding a credential to a user, device, or account. In mature identity programmes, issuance is a governed control point, not a convenience step, because it determines who can obtain access, how assurance is established, and how recovery is handled.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org