TL;DR: NIS2 pushes critical infrastructure operators toward passwordless access, because username and password controls remain exposed to phishing, reuse, and disruption in regulated environments, according to RSA Security. The real issue is that access assurance now has to survive suppliers, contractors, and legacy systems without relying on static credentials.
At a glance
What this is: This is RSA Security's analysis of why passwordless identity security matters for NIS2-regulated critical infrastructure, with the key finding that static passwords no longer align with the access risk profile of regulated operational environments.
Why it matters: It matters because IAM teams supporting critical infrastructure, suppliers, and contractors need access controls that reduce phishing and credential-reuse exposure without weakening operational continuity.
Context
NIS2 raises the baseline for access control in critical infrastructure because the old assumption that a password is a sufficient proof of trust no longer holds in regulated, high-impact environments. Passwordless identity security shifts the access question from memorising and reusing secrets to proving possession or biometric presence through cryptographically bound methods.
That change matters most where access spans employees, suppliers, contractors, and legacy systems that cannot all be modernised at once. The governance problem is not only authentication strength, but whether the access model can support continuity, auditability, and resilience while reducing the blast radius of compromised credentials.
Key questions
Q: What breaks when critical infrastructure still relies on passwords under NIS2?
A: Reusable passwords leave critical infrastructure exposed to phishing, reuse, and credential interception, so the access decision can be defeated before the user reaches the application. Under NIS2, that is not just an authentication weakness. It is a resilience problem because a single compromised login can become an entry point to operational disruption.
Q: Why do passwords create more risk in supplier and contractor access?
A: Suppliers and contractors often need access from different devices, locations, and lifecycle states than employees, yet password-based governance treats them as if they were the same. That mismatch increases the chance of weak recovery, inconsistent MFA, and reused credentials, which makes third-party access a common failure point in regulated environments.
Q: When should organisations prioritise pilot groups and early adopters in a passwordless rollout?
A: They should do it at the start, before broad deployment. Early adopter groups expose workflow issues, training gaps, and edge cases across roles, devices, and locations. A controlled pilot gives security and IT teams time to refine guidance, test support processes, and build credibility with leadership and end users.
Q: Why do remote workforce environments increase the need for Zero Trust and passwordless access?
A: Remote work expands the number of devices, applications, and third parties that must be trusted across distributed environments. That increases exposure if access decisions rely on static credentials or fragmented controls. Zero Trust and passwordless approaches reduce dependency on passwords, limit implicit trust, and help organizations verify users more consistently across cloud and remote access paths.
Technical breakdown
Why password-based access fails in NIS2 critical infrastructure
Password-based access fails in critical infrastructure because it depends on shared human behaviours that are easy to phish, reuse, and intercept. In regulated environments, that creates an avoidable control gap: the identity check is often weaker than the operational risk it protects. Passwordless identity security replaces memorised secrets with cryptographically bound methods such as FIDO2 keys, device biometrics, or risk-adaptive authentication, which reduce credential replay and make account compromise harder to scale across high-value access paths.
Practical implication: treat password retirement as an access-control redesign, not a cosmetic login change.
How passwordless changes supplier and contractor access
Supplier and contractor access is where passwordless design becomes a governance issue, not just an authentication upgrade. Third parties often need narrow, time-bound access into environments that cannot tolerate weak shared credentials or inconsistent MFA coverage. Passwordless access helps remove reusable secrets from those paths, but only if enrolment, device trust, and recovery processes are controlled with the same rigour as internal access. Without that discipline, organisations simply move the risk from password theft to weak identity proofing or poor lifecycle management.
Practical implication: define separate assurance rules for third-party access rather than extending employee login patterns by default.
Why zero trust and passwordless are linked in regulated environments
Zero Trust Architecture and passwordless access reinforce each other because both assume every request must be verified in context. In NIS2 settings, that means the access decision should not rely on a one-time password event that can be replayed later. The more sensitive the environment, the more the identity signal needs to be resistant to phishing and usable across legacy and cloud systems alike. Passwordless is therefore not a substitute for Zero Trust, but one of the stronger ways to make continuous verification practical.
Practical implication: align passwordless rollout with Zero Trust policy design so verification, not secrets, becomes the default access boundary.
Threat narrative
Attacker objective: The attacker aims to use weak authentication to reach operational systems and disrupt essential services.
- Entry occurs when an attacker obtains or guesses a reusable password and uses it to reach a critical infrastructure access path.
- Credential access succeeds because the same password can be reused, phished, or intercepted across regulated access workflows.
- Impact follows when access to operational controls enables service disruption, as illustrated by ransomware-driven interference with critical services.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Password reliance is now an access-governance liability in critical infrastructure. NIS2 pushes the control discussion beyond login convenience and into resilience, because passwords are both human-dependent and easy to abuse at scale. In regulated sectors, that makes them a poor foundation for high-impact access paths. The practitioner conclusion is straightforward: if the access model still depends on reusable secrets, the governance model is already behind the regulatory demand.
Cryptographically bound authentication changes the trust model, not just the user experience. FIDO2 keys, device biometrics, and risk-adaptive checks matter because they reduce replayable credentials and raise the cost of phishing-based compromise. That shift aligns with passwordless identity security principles in OWASP-NHI by reducing the opportunity for secret leakage and reuse. The practitioner conclusion is to evaluate whether your assurance level is actually improving, not whether the sign-in flow feels modern.
Identity has become part of operational resilience, not a separate security layer. In energy, transport, healthcare, and finance, access control is now inseparable from continuity planning because compromised credentials can turn directly into service disruption. NIS2 effectively makes access assurance a resilience control. The practitioner conclusion is that IAM, PAM, and operational security teams have to govern access as infrastructure, not as an isolated authentication project.
Third-party access exposes the weakest assumption in password-era governance. Suppliers and contractors often inherit access patterns designed for employees, even though their lifecycle, device trust, and recovery processes are different. That creates access models that look consistent on paper but fail under real operational pressure. The practitioner conclusion is to separate third-party assurance from internal workforce assumptions and treat access path design as a regulated control boundary.
Passwordless identity security is a runtime control, not a compliance label. The value is not in claiming password elimination, but in reducing the number of places where a stolen secret can become a successful intrusion. In practice, that means the real test is whether access decisions remain strong across legacy, cloud, and delegated environments. The practitioner conclusion is to measure the control by exploit resistance, not by deployment count.
From our research library:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
What this signals
Passwordless access becomes a governance control only when it is tied to assurance levels, recovery design, and third-party lifecycle rules. In critical infrastructure, the question is not whether passwords disappear, but whether every access path can be proven resistant to phishing and credential reuse across employees, suppliers, and contractors.
Identity assurance and operational resilience now move together. When access protects essential services, a weak login is no longer just an IAM issue. It becomes a service continuity issue that needs the same level of ownership from security, operations, and compliance teams.
For practitioners
- Map critical access paths to password exposure Identify which operational accounts, supplier logins, and contractor pathways still depend on reusable passwords, then rank them by business criticality and exposure to phishing or reuse.
- Phase in phishing-resistant authentication Prioritise FIDO2 hardware keys, mobile biometrics, or equivalent phishing-resistant methods for privileged and high-impact access before expanding to lower-risk workflows.
- Separate third-party access governance Apply distinct enrolment, recovery, and assurance rules for suppliers and contractors so their access does not inherit employee assumptions about device trust or lifecycle handling.
- Align passwordless rollout with Zero Trust policy Make every access request subject to contextual verification, and ensure passwordless controls are embedded in the policy layer rather than added as a stand-alone login option.
Key takeaways
- Password-based access remains a poor fit for regulated critical infrastructure because it is easy to phish, reuse, and scale into disruption.
- The article's central example shows how a reused or guessed password can turn into operational impact in a high-consequence environment.
- Phishing-resistant authentication, third-party-specific governance, and Zero Trust policy alignment are the practical levers that matter most.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the technical controls, and NIS2 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article is centered on replacing weak password-based access in regulated environments. |
| NHI-07 — Long-Lived Secrets | Password reuse and persistence are the core weaknesses the article argues against. | |
| NHI-10 — Human Use of NHI | The article discusses employees, suppliers, and contractors accessing sensitive systems through identity controls. | |
| Recommendation — Replace reusable passwords with phishing-resistant authentication for critical and third-party access paths. Eliminate long-lived credentials from critical infrastructure login workflows and recovery paths. Prevent human users from relying on shared or reusable secrets when accessing regulated systems. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture — Zero Trust Architecture | The article explicitly recommends verifying every access request in a Zero Trust model. |
| Recommendation — Embed contextual verification into every access decision rather than trusting a password as proof. | ||
| NIS2 | Art. 21 — Cybersecurity risk-management measures | The topic is passwordless access for NIS2-regulated critical infrastructure. |
| Recommendation — Use NIS2 risk-management obligations to justify stronger access controls for critical services. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | Passwordless authentication and phishing resistance map directly to digital identity authentication guidance. |
| Recommendation — Apply authentication guidance to prioritise phishing-resistant methods over reusable passwords. | ||
Key terms
- Passwordless Identity Assurance: Passwordless identity assurance is the degree to which an authentication programme can verify a user without relying on passwords as a routine or fallback method. In practice, it depends on the reliability of biometrics, device binding, recovery, and exception handling across the full enterprise estate.
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Zero Trust: A security model that assumes no identity, human or non-human, should be trusted by default, even inside a network perimeter. Every access request must be verified, authorised, and continuously validated.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org