Passwordless identity is becoming the new IAM control plane

At a glance

What this is: This is a vendor analysis arguing that passwordless identity, passkeys and phishing-resistant MFA are shifting from experimentation to IAM operating model design.

Why it matters: It matters because IAM teams now need to govern authentication as a control plane decision across human identity, federation and emerging portable credentials, not as a point solution choice.

Context

L'article traite d'un changement de gouvernance de l'authentification, pas d'une simple mise à jour de connexion. Le problème central est que les attaques de collecte d'identifiants, de phishing et d'échange de SIM évoluent plus vite que les approches IAM construites autour du mot de passe et des MFA classiques.

Pour les programmes d'identité, la question devient de savoir comment industrialiser des mécanismes plus résistants, comme les passkeys et la MFA résistante au phishing, sans perdre la portabilité, l'interopérabilité ni la visibilité de gouvernance. Cela place l'authentification au cœur du plan de contrôle IAM plutôt qu'en périphérie de l'expérience utilisateur.

Key questions

Q: How should IAM teams govern passwordless identity without weakening assurance?

A: IAM teams should separate the convenience of passwordless login from the strength of identity proofing. A passwordless experience is only as trustworthy as the enrolment and recovery process behind it, so assurance tiers, fallback methods, and revocation paths must be defined before broad rollout. That keeps user experience improvements from diluting access governance.

Q: Why do passkeys and phishing-resistant MFA still need governance oversight?

A: Because stronger authentication does not eliminate lifecycle risk. Organisations still need to manage who can enroll, how accounts are recovered, when assurance is downgraded, and how exceptions are approved. Without that oversight, passwordless becomes a stronger front door with the same weak back office.

Q: What breaks when organisations deploy passwordless login before fixing fallback flows?

A: The weakest recovery path becomes the new attack surface. If password reset, device replacement, federation exceptions or help desk overrides still accept low-assurance proof, attackers can bypass the stronger primary factor by targeting the exception process instead of the login process.

Q: What is the difference between passwordless authentication and portable verifiable credentials?

A: Passwordless authentication changes how a user proves possession at login, while portable verifiable credentials change how trusted identity assertions can move between systems. One improves the login event, the other addresses reuse, portability and selective disclosure across ecosystems, which makes the governance problem broader than authentication alone.

Technical breakdown

Why passwordless identity changes the IAM control plane

Passwordless identity changes the control plane because authentication stops being a single credential event and becomes a policy, device and federation decision. Passkeys, phishing-resistant MFA and decentralized credentials shift trust away from shared secrets and toward cryptographic possession plus ecosystem support. That matters because identity teams must now govern where credentials live, which devices can use them, and how the same identity proof is reused across services. The operational question is no longer whether passwordless works in principle, but whether the surrounding IAM stack can enforce consistent assurance across channels and vendors.

Practical implication: Treat passwordless as an architecture change, not a login feature.

Passkeys, phishing-resistant MFA and portable identity credentials

Passkeys reduce reliance on reusable passwords, while phishing-resistant MFA raises the bar against credential theft and adversary-in-the-middle attacks. But neither control is automatically portable across every workforce or customer environment. The article also points to AuthZEN and OID4VC, which signal a move toward continuous authorisation and reusable verifiable credentials. That combination matters because organisations will need to decide which identity assertions stay local, which can be reused, and which assurance level is acceptable when the user moves between devices, apps and ecosystems.

Practical implication: Design credential portability and assurance levels together, not as separate projects.

Why ecosystem integration now matters more than adoption alone

Adoption is only half the problem. Once passwordless and passkeys reach production scale, the hard work shifts to integration with directories, policy engines, app protocols, help desk processes and lifecycle governance. Without that integration, organisations create islands of stronger authentication that still rely on weak fallback paths, recovery flows or inconsistent federation rules. The article’s direction of travel is clear: IAM teams that modernise one login path but leave adjacent flows unchanged will preserve the very gaps passwordless was meant to remove.

Practical implication: Map every fallback and recovery path before declaring a passwordless rollout complete.

NHI Mgmt Group analysis

Passwordless identity is becoming the new IAM control plane because the control problem has moved upstream. The old model treated authentication as a front-door event that could be solved with stronger factors. This article shows that the real issue is how identity assertions, device trust and portability are governed across the full access journey. Practitioners should stop treating passwordless as an endpoint and start treating it as the policy layer that coordinates access decisions.

Reusable secret dependence is the governance assumption that passwordless begins to dismantle. Password-based IAM assumes a reusable credential will remain the primary trust anchor across channels and recovery flows. That assumption weakens once passkeys, phishing-resistant MFA and decentralized credentials enter the model because the identity is no longer anchored to a single secret. The implication is that governance must move from secret-centric control to lifecycle and assurance-centric control.

AuthZEN and OID4VC signal that identity programmes are moving from authentication events to continuous trust orchestration. That creates a different governance burden for human IAM because policy decisions must travel with the identity rather than be recreated at each application boundary. The useful insight here is not that every organisation must adopt these standards immediately, but that architecture choices made now should not block portability later. Practitioners should evaluate whether their current stack can express and preserve trust beyond the initial login.

The passwordless era will expose fallback paths as the real weak points. Help desk reset flows, recovery channels, device enrolment exceptions and federation shortcuts become the places where old risk re-enters the environment. This is why scaling passwordless is as much a lifecycle and exception-management problem as it is an authentication problem. Security teams should examine where their current controls silently reintroduce passwords, shared secrets or low-assurance recovery steps.

Post-password identity governance will reward organisations that can govern trust across platforms, not just inside them. The direction of travel is toward interoperable identity proofing, portable credentials and stronger assurance at scale. That raises the value of standards-aware IAM architecture and lowers the value of point solutions that cannot participate in broader federation or authorisation models. Practitioners should plan for a control environment where identity is increasingly embedded in the application and device fabric.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Le contrôle d'accès devient un problème de trajectoire, pas seulement de point d'entrée. Lorsque l'authentification sans mot de passe s'étend, les équipes IAM doivent cartographier où une identité peut retomber vers des flux hérités, car c'est là que le risque réapparaît. Le bon test n'est pas seulement la réussite du login, mais l'absence de chemins de secours faibles tout au long du cycle de vie.

Passkeys and verifiable credentials point to a future where identity is governed as a reusable trust signal. That increases the value of lifecycle coordination across enrolment, federation and recovery, because the same assertion may now travel farther than a password ever did. Teams that modernise authentication without modernising exception handling will still own the same governance debt, only behind a stronger front door.

For practitioners

• Map fallback authentication paths Identify every password reset, account recovery, help desk override and legacy federation path that can reintroduce weak authentication after passwordless adoption.
• Pilot passkeys in high-friction journeys Start with workforce and customer flows where phishing and password fatigue create the most risk, then measure recovery exceptions and support load.
• Test continuous authorisation assumptions Validate whether your application and policy stack can preserve assurance decisions beyond the initial login, especially where AuthZEN-style patterns are being considered.
• Separate portability from enrollment Document where credentials can be reused across platforms, where re-enrollment is required, and where privacy or assurance constraints should block reuse.
• Rework authentication roadmap sequencing Sequence passwordless, phishing-resistant MFA and verifiable credential work so the recovery, federation and lifecycle controls are ready before broad rollout.

Key takeaways

• Passwordless identity shifts IAM responsibility from protecting a reusable secret to governing trust across devices, recovery and federation.
• The article’s core risk is not whether passkeys work, but whether adjacent fallback paths preserve old weaknesses after deployment.
• IAM teams should sequence passwordless adoption with recovery, portability and lifecycle controls already defined.

Key terms

• Passwordless Identity Assurance: Passwordless identity assurance is the degree to which an authentication programme can verify a user without relying on passwords as a routine or fallback method. In practice, it depends on the reliability of biometrics, device binding, recovery, and exception handling across the full enterprise estate.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Continuous authorization: Continuous authorization is the practice of rechecking access as a session unfolds instead of trusting a single login decision. It matters for AI workflows because the request, context, retrieved data, and downstream action can all change between prompt and execution, making static approval too blunt.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.