Topic starter
08/06/2026 4:01 pm
TL;DR: Enterprises are increasingly treating FIDO and certificate-based authentication as complementary rather than competing methods, because FIDO remains uneven across environments while CBA already fits user and machine identity use cases today, according to Axiad. The practical issue is not choosing one standard but aligning each to the authentication problem it solves without creating governance gaps.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “CBA AND FIDO: One, Other, or Both?”.
Key questions
Q: How should security teams choose between FIDO and certificate-based authentication?
A: Security teams should choose by identity type, environment maturity, and lifecycle control.
Q: Why do organisations still need certificate-based authentication when FIDO exists?
A: Because FIDO is not designed to cover every identity context.
Q: What are the signs that a single authentication standard is not enough?
A: The clearest signs are inconsistent support across operating systems, exceptions for managed devices, and separate processes for users versus workloads.
Practitioner guidance
- Define authentication by identity type Separate human interactive sign-in, managed device access, and workload authentication before choosing a control.
- Use FIDO where phishing resistance matters Prioritise FIDO for user sign-in flows that are internet-facing and high risk for credential replay or phishing.
- Retain CBA for managed endpoints and workloads Use certificate-based authentication where PKI-backed trust, device binding, or workload identity support is the operational requirement.
Bottom line: FIDO and certificate-based authentication address different identity subjects, so IAM teams should not treat them as interchangeable controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:24 pm
Authentication standardisation fails when teams confuse coverage with control quality. The article's core point is that FIDO and certificate-based authentication solve different identity problems, so a single-method policy can create blind spots. Human sign-in, managed endpoints, and machine identities do not all share the same trust mechanics. The practitioner conclusion is to govern authentication by identity type and use case, not by technology preference.
A question worth separating out:
Q: What should teams do when FIDO does not cover a required use case?
A: Use the method that fits the use case and document why. In many environments, that means keeping certificate-based authentication for device or workload scenarios while adopting FIDO for human sign-in. The goal is consistent assurance, not uniformity for its own sake.
👉 Read our full editorial: CBA and FIDO together: what identity teams should do now
This post was modified 4 days ago by NHI Mgmt Group