Notifications
Clear all
Topic starter
12/07/2026 12:27 pm
TL;DR: Passwordless authentication, SSO, AI-driven threat detection, and zero trust are presented by Soffid as complementary controls that reduce password attack surface, improve identity assurance, and tighten access to only what each user needs. The deeper issue is that IAM programmes still need to align authentication, authorization, and monitoring instead of treating them as separate projects.
NHIMG editorial — based on content published by Soffid: The Rise of Passwordless Authentication
Questions worth separating out
Q: How should security teams implement passwordless authentication without increasing access risk?
A: Security teams should implement passwordless in stages, starting with low-risk use cases and then expanding only after enrollment, recovery, and session controls are proven.
Q: Why do zero trust and SSO need to be aligned in identity programmes?
A: SSO centralizes authentication, but zero trust determines what happens after authentication succeeds.
Q: What do security teams get wrong about threat detection in IAM?
A: Teams often treat detection as a logging problem instead of an access-governance problem.
Practitioner guidance
- Map passwordless fallback paths Inventory every place users can still authenticate with passwords, including legacy apps, recovery methods, and privileged break-glass accounts.
- Bind SSO to contextual authorization Review whether authenticated sessions are still constrained by device posture, role, location, and resource sensitivity.
- Separate detection from entitlement cleanup Use AI-based monitoring to flag anomalous access, but route findings into ownership review, entitlement correction, and revocation workflows.
What's in the full article
Soffid's full article covers the practical explanation this post intentionally leaves at the strategy level:
- How passwordless authentication is described in relation to digital identity verification and policy enforcement
- How SSO is positioned as a way to reduce user friction while narrowing the attack surface
- How AI and machine learning are described as threat detection tools in modern cybersecurity operations
- How zero trust is framed as an access model built around explicit verification and minimal permissions
👉 Read Soffid's article on passwordless authentication and zero trust →
Passwordless and zero trust: what IAM teams need to recheck?
Explore further
12/07/2026 12:39 pm
Passwordless authentication reduces secret exposure, but it does not eliminate identity governance work. Removing passwords lowers phishing and reuse risk, yet it also increases the importance of device trust, recovery flows, and fallback authentication paths. The control gap shifts from password hygiene to assurance orchestration. IAM teams should treat passwordless as a credential model change, not a finished security outcome.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations know whether passwordless access is actually improving security?
A: Look for reduced password dependence, fewer lockouts, lower help desk reset volume, and stronger control over high-risk workflows such as shared workstation access and privileged clinical systems. If user friction drops while identity assurance rises, the programme is moving in the right direction.
👉 Read our full editorial: Passwordless authentication and zero trust are reshaping IAM
