Notifications
Clear all
Topic starter
11/07/2026 1:57 pm
TL;DR: Authentication is shifting toward digital IDs, passkeys, transaction-based trust, and AI agents, with the article arguing that 2026 will be the year these patterns move from preview to production, according to Authsignal. The practical issue is not adoption alone, but whether IAM programmes can govern delegated access, step-up decisions, and revocation when identity becomes more dynamic.
NHIMG editorial — based on content published by Authsignal: 5 authentication trends that will define 2026: Our founder's perspective
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
A: Security teams should separate identity proof, session trust, and action authorisation.
Q: Why do passkeys not eliminate the need for recovery controls?
A: Passkeys reduce phishing and password reuse, but they do not remove account recovery.
Q: When should organisations move from session-based trust to transaction-based trust?
A: Organisations should move when one authenticated session can support actions with very different risk levels.
Practitioner guidance
- Map digital ID reliance points Identify which onboarding, authentication, and high-risk transaction flows could accept portable digital credentials, then define assurance thresholds before integration.
- Inventory every fallback authentication path Document passwords, SMS OTP, help-desk resets, and recovery exceptions that still bypass passkeys.
- Redesign step-up for transaction risk Move from session-wide trust to per-action re-evaluation for sensitive transfers, privilege changes, and delegated approvals.
What's in the full article
Authsignal's full blog covers the operational detail this post intentionally leaves for the source:
- Practical examples of how passkey-first authentication is changing product design decisions in consumer apps
- Specific rollout patterns for digital IDs across regions and what they imply for onboarding and verification workflows
- The author’s view on how AI agents will change authentication patterns for delegated access and auditability
- Implementation guidance for building transaction-based trust into real application flows
👉 Read Authsignal’s analysis of 2026 authentication trends and AI agents →
Authentication in 2026: digital trust, passkeys, and agent risk?
Explore further
11/07/2026 2:08 pm
Digital trust is now an identity governance problem, not just an authentication problem. The article is right that digital IDs and passkeys are moving from optional to expected, but the field has to treat this as a governance shift rather than a UX upgrade. Once identity proof becomes portable, the control question becomes which relying parties can trust which credentials, under what assurance level, and with what recovery path. Practitioners should stop thinking in isolated login flows and start governing trust relationships.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when an AI agent acts on behalf of a user?
A: Accountability should sit with the organisation that granted the delegation and defined the policy, not with the software actor alone. The human principal remains responsible for the intent, but the system must log which permissions were delegated, how they were bounded, and how they can be revoked before the agent completes a sensitive task.
👉 Read our full editorial: 2026 authentication trends point to digital trust and AI agents
