Passwordless identity is now central to Zero Trust resilience

At a glance

What this is: This is a Zero Trust and identity governance analysis arguing that passwordless identity is now the practical foundation for resilient access in critical infrastructure, OT, and mobile environments.

Why it matters: It matters because IAM and PAM teams supporting critical services need controls that survive phishing, credential reuse, and mixed IT/OT access patterns without weakening continuous verification.

Context

Zero Trust in critical infrastructure depends on whether identity can be verified continuously across users, devices, and operational environments. Passwords, shared credentials, and broad trust assumptions weaken that model because they let attackers reuse one compromise point across IT and OT systems.

RSA Security frames passwordless identity as the mechanism that tightens access decisions around cryptographic trust, device context, and anomaly detection. The article is aimed at critical services, so the governance issue is less about user convenience and more about sustaining resilient access when the attack surface spans SCADA, mobile workforces, and connected devices.

Key questions

Q: What breaks when critical access still depends on passwords in a Zero Trust model?

A: Passwords preserve a reusable secret that attackers can phish, brute-force, or replay, which undermines continuous verification. In critical infrastructure, that weakness is amplified because one compromised identity can reach remote admin paths, operational systems, or mobile workflows that were assumed to be trusted.

Q: Why do risk-adaptive authentication controls matter more in OT and critical services?

A: Because the same identity can behave differently depending on device posture, location, role, and whether the request touches an operational or business system. Risk-adaptive controls let teams raise assurance when the context is abnormal, which is essential when one access path can affect service continuity.

Q: Should organisations prioritise passwordless or identity verification first?

A: They should treat them as complementary controls rather than competing projects. Passwordless removes phishable credentials, while identity verification hardens the moments when people are asserted, recovered, or re-enrolled. If resources force sequencing, start with the workflows most exposed to impersonation and account takeover.

Q: What is the difference between certificate-based authentication and password-only login?

A: Certificate-based authentication uses a digital certificate and private key to prove identity, while password-only login depends on a memorized secret. Certificates can authenticate both the user and the machine, and they support mutual authentication. Password-only methods are easier to misuse or steal, which is why certificate-based authentication is often used as a stronger layer for network and application access.

Technical breakdown

Passwordless identity as the control plane for Zero Trust

Zero Trust only works when every access decision can be tied to a strong identity signal at request time. Passwordless methods reduce reliance on reusable secrets and shift assurance toward cryptographic authenticators, device-bound factors, and policy evaluation. In critical infrastructure, that matters because operators often span fixed industrial assets, remote access, and mobile endpoints. If identity proof remains password-centric, the trust model becomes as weak as the most reusable credential in the environment.

Practical implication: treat passwordless as the access-control foundation, not as a cosmetic authentication upgrade.

Risk-adaptive authentication for IT and OT environments

Risk-adaptive authentication evaluates context such as role, device posture, and geolocation before allowing access. That is especially useful in mixed IT and OT estates, where the same user may need different assurance levels depending on whether the request touches a business app, a remote admin path, or an operational system. The technical value is not just friction reduction. It is the ability to make authorisation responsive to session context instead of assuming one static policy fits every environment.

Practical implication: define which contextual signals must gate access to operational systems before you extend remote privilege.

Certificate-based identity and trusted device access

Certificate-based identity gives organisations a stronger trust anchor than passwords because the credential is bound to a managed cryptographic identity rather than a memorised secret. In Zero Trust programmes, this supports device and user verification while reducing exposure to phishing and credential replay. For critical services, certificates also fit better with environments where access must be granted only to known devices and approved endpoints. The limitation is governance, not theory. Certificates still need lifecycle control, revocation discipline, and clear ownership.

Practical implication: govern certificate lifecycle and revocation as part of identity assurance, not as a separate PKI exercise.

Threat narrative

Attacker objective: The attacker wants a trusted access path into critical services so they can move into operational systems, disrupt continuity, or stage wider compromise.

1. Entry begins with password reuse, phishing, or brute-force compromise against identities that still depend on shared or memorable secrets.
2. Escalation follows when the compromised credential opens access to critical services, remote admin paths, or operational environments that were assumed to be trusted.
3. Impact occurs when ransomware, supply-chain intrusion, or other malicious activity moves through that trust path before the organisation detects the anomaly.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwordless identity is now the control boundary Zero Trust depends on. When passwords remain the primary authenticator, the Zero Trust model still inherits a reusable-secret failure mode that attackers already know how to exploit. In critical infrastructure, that weakness is amplified by OT, SCADA, remote operations, and mobile access patterns. The practical conclusion is that identity assurance must shift from shared secrets to cryptographic trust.

Zero Trust in critical services is really a resilience programme disguised as an access model. The article’s emphasis on operational continuity is important because the governing question is not only who can log in, but whether identity controls remain dependable under incident pressure. NIS2, ransomware disruption, and supply-chain compromise all make weak identity the shortest path to service interruption. Practitioners should therefore evaluate access controls by how well they preserve operations under stress.

Risk-adaptive authentication is the right answer to context, but only if governance defines the context that matters. Context-aware access is not a substitute for policy clarity. It only works when security teams decide which device, location, role, and system signals should change the trust decision. Without that governance, adaptive controls become inconsistent rather than intelligent. The practitioner implication is to define risk signals before automating response.

Certificate-based identity closes one trust gap but opens a lifecycle obligation. Certificates reduce reliance on passwords, but they do not remove the need for ownership, revocation, and expiry discipline. That makes identity governance and PKI operations part of the same control plane. Organisations that separate them create a false sense of assurance. The real challenge is to manage cryptographic identity as an active lifecycle, not a one-time enrollment event.

Identity blast radius becomes the decisive metric in mixed IT and OT environments. Passwordless controls reduce the number of reusable entry points, which shrinks how far one compromise can travel. That matters more than isolated authentication hardening because critical services fail when one credential exposes too much of the environment. Teams should measure whether their identity design limits cross-domain movement, not just whether users can authenticate without passwords.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Identity assurance has become a resilience control, not just an access control. Critical services should assume that the first compromised secret will be used as an operational foothold, so the programme question is how much damage a single identity can do before detection. Passwordless and certificate-backed access reduce that blast radius when they are paired with explicit ownership and revocation discipline.

Passwordless adoption only delivers value when it is anchored to governance decisions. Teams need to decide which workflows can tolerate adaptive challenges, which devices deserve cryptographic trust, and which roles should never rely on shared secrets again. That is a policy and operating-model change, not just a login modernization.

Zero Trust becomes credible only when verification is continuous across IT and OT. The more your environment blends operational systems, mobile users, and remote administration, the more identity controls must prove they can discriminate trusted access from risky access in real time. That is the point where passwordless identity stops being a preference and becomes an operating requirement.

For practitioners

• Define passwordless coverage for critical access paths Map which remote access, privileged admin, SCADA-adjacent, and mobile access paths still depend on passwords, then prioritise the highest-consequence ones for replacement first.
• Tighten risk signals for adaptive authentication Choose the device, location, role, and session signals that should raise or lower trust for each critical service, and document them before enabling policy automation.
• Treat certificates as governed identity assets Assign clear ownership, expiry, and revocation responsibilities for certificate-based identity so that cryptographic trust does not outlive the systems and users it protects.
• Limit the blast radius of one identity compromise Review whether a single compromised account could reach both business systems and operational environments, then reduce cross-domain privilege and shared trust wherever possible.

Key takeaways

• Passwords remain the most fragile part of Zero Trust when critical services still depend on reusable secrets for remote and operational access.
• The article ties resilience to continuous verification across IT, OT, and mobile environments rather than to a single authentication method.
• Practitioners should prioritise passwordless coverage, certificate governance, and context-aware policy around the highest-consequence access paths.

Key terms

• Passwordless Identity Assurance: Passwordless identity assurance is the degree to which an authentication programme can verify a user without relying on passwords as a routine or fallback method. In practice, it depends on the reliability of biometrics, device binding, recovery, and exception handling across the full enterprise estate.
• Adaptive Authentication: Adaptive authentication changes the strength of login checks based on context such as device, location, source network, and session history. It helps IAM teams respond to suspicious access without forcing every user through the same high-friction path.
• Certificate-Based Device Identity: Certificate-based device identity is the use of public-key credentials to identify and verify a connected device before it is allowed into a trusted environment. For smart and IoT fleets, this turns onboarding, trust, and revocation into governed identity lifecycle processes rather than manual pairing tasks.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.