Topic starter
08/06/2026 4:03 pm
TL;DR: FIDO Alliance’s new working groups target identity verification for account recovery and passwordless device onboarding for IoT, while Axiad notes that non-person entities already represent over 30% of identities in its cloud service. The governance gap is broader than authentication alone: enterprises now need identity assurance that spans people, devices, and transactions.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “FIDO Alliance takes aim at two new cybersecurity challenges. Why should your enterprise care?”.
By the numbers:
- Today authentication for non-person entities represents over 30% of the identities on Axiad ID Cloud.
Key questions
Q: What breaks when account recovery is easier than primary authentication?
A: Attackers target the recovery path because it often carries enough trust to bypass stronger login controls.
Q: Why do non-person entities need the same lifecycle discipline as user identities?
A: Because machine identities now make up a substantial share of enterprise identity populations and they can create the same access and audit risks as humans, only at higher scale.
Q: When should organisations add transaction authentication instead of relying on session login?
A: They should add it when the action itself carries higher risk than ordinary access, such as privileged changes, financial approvals, or device-control operations.
Practitioner guidance
- Strengthen recovery verification Require recovery workflows to use proofing, approval, and audit steps that are independent from the primary authentication factor.
- Inventory non-person entities Maintain a complete inventory of devices, applications, and systems that authenticate into corporate resources.
- Bind device onboarding to identity controls Use certificate- or hardware-backed identity binding for device onboarding where possible, and make revocation part of the same workflow.
Bottom line: Account recovery is now a primary control surface because passwordless and MFA environments leave the recovery path as the easiest place for assurance to fail.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:28 pm
Account recovery has become a first-class identity control, not a support function. When organisations reduce password reliance, they often leave recovery logic behind in a weaker, less governed state. That creates a trust gap where the path back into an account is easier to attack than the primary sign-in flow. The implication is that recovery must be governed as part of the authentication architecture, not bolted on after the fact.
A question worth separating out:
A: Treat account recovery as part of the authentication design, not as an afterthought. The strongest approach combines phishing-resistant login, self-service recovery, and adaptive checks that reduce call center dependence while keeping legitimate users moving. If recovery is slow or confusing, customers abandon the journey, so teams should measure friction, recovery success, and support load together.
👉 Read our full editorial: FIDO’s focus on account recovery and device identity changes IAM
This post was modified 4 days ago by NHI Mgmt Group