Passwordless MFA fails when legacy identity paths still remain

At a glance

What this is: This analysis argues that passwordless MFA only reduces identity-led attack risk when it reaches every meaningful access path, because legacy fallback routes and standing privilege can still be used to trigger destructive action.

Why it matters: IAM and PAM teams need to treat passwordless as an enterprise coverage problem, not a point-solution rollout, because residual credential paths and privileged workflows remain the fastest route to blast-radius expansion.

Context

Passwordless MFA is often described as an authentication upgrade, but the real governance issue is coverage. If desktop login, VPN, legacy applications, and privileged workflows still accept password-backed fallbacks, attackers can pivot through the weakest surviving path rather than the most modern one.

The article frames the Stryker/Handala incident as a reminder that identity-led attacks become catastrophic when one compromised identity can still reach administrative control planes. In that model, the failure is not the absence of passwordless support in one app; it is incomplete identity-path coverage across the enterprise.

For identity programmes, the operational question is whether passwordless and privileged access controls are aligned end to end. Where legacy exceptions remain, the environment still behaves like a password-centric estate even if the front end looks modern.

Key questions

Q: What fails when passwordless MFA still leaves legacy authentication paths in place?

A: The failure is coverage, not the authentication method itself. If VPN, legacy apps, emergency access, or remote management still accept password-backed flows, attackers can move through the remaining trusted path and reach the systems that matter most. Passwordless only changes risk when the entire identity path is modernized, including fallback routes and privileged workflows.

Q: Why do standing administrative privileges make identity compromise so damaging?

A: Standing privilege turns a valid identity into immediate operational reach. When an attacker gets into an account that already holds destructive or high-impact permissions, they do not need a second exploit to cause harm. That is why blast radius is governed by privilege persistence, session scope, and approval friction, not only by the strength of the initial login control.

Q: What signals show that passwordless coverage is not complete enough?

A: Look for any system that still accepts a user-entered password, any workforce segment excluded from phishing-resistant MFA, and any application that depends on a hidden fallback secret. If those paths exist, the programme is still operating with exploitable identity debt.

Q: What should teams do when remote management tools can wipe or alter endpoints?

A: Treat those tools as privileged execution surfaces and constrain them accordingly. The practical test is whether a compromised admin session can trigger broad changes without extra verification, time limits, or just-in-time elevation. If the answer is yes, the tool is part of the blast radius, not just a support utility.

Technical breakdown

Why partial passwordless coverage still leaves exploitable identity paths

Passwordless authentication removes user-managed secrets from the login step, but it does not automatically remove every credential-backed route into the enterprise. Legacy applications, VPNs, and remote management tools often preserve fallback paths because they were built around passwords, shared administrative workflows, or weaker recovery logic. That creates an uneven trust fabric: some sessions are phishing-resistant, while others still accept old assumptions about who can connect and how. The security issue is not modern authentication itself, but the mixed estate it coexists with. If one route still accepts a password or a recoverable credential, that route becomes the attacker’s preferred path.

Practical implication: map every remaining password-backed authentication path before claiming passwordless coverage.

Standing privilege and remote management as blast-radius multipliers

Standing privilege turns identity compromise into operational impact because the account already holds the permissions needed to act. In destructive incidents, remote management tools, admin consoles, and endpoint control planes can become force multipliers when they are reachable through trusted credentials. This is why credential theft is only the entry condition, not the full story. The escalation happens when a privileged identity can execute high-impact actions without additional friction, session scoping, or approval gates. In identity terms, the control failure is privilege persistence, not just bad authentication.

Practical implication: pair passwordless rollout with removal of standing administrative access on high-risk workflows.

Why legacy exception handling defeats an otherwise modern identity programme

Legacy exceptions are often treated as temporary operational compromises, but they become durable attack surfaces when they persist across years of application drift. The article’s central warning is that passwordless MFA can be true in marketing language while false in practice if on-prem systems, old apps, and emergency access channels still depend on password-backed workflows. That means identity governance has to be measured by surviving exception paths, not by the percentage of modern apps onboarded. A passwordless programme that leaves untreated exceptions behind is still a password programme in the places that matter most.

Practical implication: inventory and retire legacy exceptions as a formal part of passwordless governance, not as an afterthought.

Threat narrative

Attacker objective: The attacker seeks to turn trusted administrative access into enterprise-wide disruption by using legitimate identity pathways as a destruction mechanism.

1. Entry occurs through a compromised identity path or legacy password-backed workflow that still reaches the enterprise control plane.
2. Credentialed access is then used against administrative tools and remote management channels that were trusted to perform operational actions.
3. Escalation follows when standing privilege allows high-impact commands to run without additional verification or scoping.
4. Impact is achieved through destructive actions such as device wiping, data theft, and broad operational disruption.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passwordless coverage is a governance problem, not an authentication feature. Organizations do not lose control because one login path remains legacy. They lose control because that legacy path often connects to the very workflows attackers want most: remote administration, recovery, and privileged execution. The implication is that coverage must be measured across the full identity estate, not by app adoption alone.

Standing privilege is the bridge from identity compromise to destructive impact. Once an attacker inherits trusted admin pathways, the question is no longer whether they can authenticate. The question is what they can do without additional challenge, scope restriction, or time-bound access. That is why privilege persistence, not only credential quality, determines blast radius.

Legacy authentication creates identity debt that passwordless branding cannot hide. A modern front end does not neutralise a password fallback buried in VPN access, on-prem software, or emergency workflows. When those exceptions remain, the programme still depends on the oldest trust model in the estate. The practitioner conclusion is simple: identity modernization only counts when exceptions are removed, not merely isolated.

Remote management tools should be treated as high-impact identity infrastructure. The Stryker case highlights a recurring pattern in destructive campaigns: attackers abuse legitimate administrative tools instead of deploying noisy exploit chains. That shifts the governance focus from endpoint-only hardening to identity-path control over the systems that can move, lock, or wipe assets. Teams should classify those tools as privileged execution surfaces, not ordinary operational utilities.

Coverage gaps are now the decisive security variable in passwordless programmes. The weak point is rarely the modern app that supports phishing-resistant authentication. It is the surviving pathway that still accepts a password, a fallback secret, or an over-entitled admin session. Practitioners should treat unfinished coverage as a category-level risk, because that is where compromise becomes operationally catastrophic.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Coverage debt is the hidden failure mode in passwordless programmes. A deployment can look mature while still relying on password fallbacks in VPN, legacy applications, emergency access, or remote administration. That means the real control objective is exception elimination, not feature adoption.

Identity-led destructive attacks expose where privilege still persists after authentication succeeds. Once a trusted session reaches administrative tooling, the attack is no longer about login quality. It becomes a question of whether high-impact actions are time-bound, scoped, and reversible.

The programme signal is clear: identity teams should measure passwordless by surviving trust paths, not by the percentage of modern applications onboarded. If a legacy route can still reach the control plane, the environment is not yet passwordless in the places that matter.

For practitioners

• Audit every surviving password-backed path Inventory desktop login, VPN, legacy applications, emergency access channels, and remote management tools to identify where password fallback still exists.
• Remove standing privilege from destructive workflows Convert high-risk administrative actions such as wipe, lockout, and remote execution into just-in-time access with explicit session scoping.
• Treat legacy exceptions as removal items Track each exception as a governed risk with an owner, expiry, and retirement plan rather than leaving it as a permanent compatibility workaround.
• Classify remote management as privileged infrastructure Apply stricter control, monitoring, and approval requirements to tools that can change endpoints at scale because they can turn one compromise into many impacts.
• Use coverage testing instead of app-by-app completion metrics Measure whether identity controls protect every meaningful access path, including legacy and on-prem systems, before declaring passwordless complete.

Key takeaways

• Passwordless MFA does not reduce risk if password-backed fallback paths still reach critical systems and administrative tools.
• Destructive incidents become scalable when standing privilege and remote management channels are still trusted after authentication.
• The control that matters most is enterprise coverage, because any surviving legacy identity path can still become the attacker’s entry to blast radius.

Key terms

• Passwordless Coverage: The proportion of an application estate that no longer depends on passwords for routine access. In practice, coverage matters more than intent, because a small set of legacy, shared, or recovery-dependent systems can preserve the same breach exposure that passwordless adoption was meant to remove.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Alternate Authentication Path: An alternate authentication path is any credential or trust relationship that can be used after the primary token is removed. Security teams miss these paths when they treat revocation as the end of the incident instead of checking for newly planted keys, app grants, or delegated sessions.
• Remote Management Plane: The control layer used to administer devices, systems, or fleets from a distance. It is high value because it can affect many assets quickly, which makes it a common escalation target when attackers inherit trusted administrative access.

Deepen your knowledge

NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or PAM programme, it is worth exploring.