Topic starter
08/06/2026 4:05 pm
TL;DR: KuppingerCole’s Leadership Compass on passwordless authentication highlights a market where password elimination, phishing resistance, and zero trust alignment are becoming central buyer criteria, while 70% of respondents report using three or more IAM ecosystems, according to Axiad. The real issue is not whether passwordless works, but whether fragmented identity estates can absorb it without adding more operational complexity.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “KuppingerCole Highlights Axiad as a Top Passwordless Authentication Provider”.
By the numbers:
- 70% of respondents have 3 or more IAM ecosystems in use.
Key questions
Q: How should security teams roll out passwordless authentication in fragmented IAM environments?
A: Start with a mapped view of directories, federation paths, and application exceptions, then choose the user populations where passwordless can be enforced consistently.
Q: Why does passwordless authentication still fail when IAM sprawl is high?
A: Because removing passwords does not remove the operational complexity behind them.
Q: What are the biggest governance mistakes in passwordless programmes?
A: The common mistake is treating passwordless as a front-end change rather than an identity governance change.
Practitioner guidance
- Audit IAM ecosystem fragmentation Inventory every directory, IdP, and application trust boundary that participates in authentication.
- Harden recovery and fallback flows Review enrollment reset, account recovery, and break-glass processes so they do not reintroduce password-based or weakly verified access paths.
- Standardise assurance policies across apps Define the assurance level required for each application tier and align federation, device trust, and session policy accordingly.
Bottom line: Passwordless authentication reduces reliance on reusable secrets, but fragmented IAM estates still determine how secure and consistent the outcome will be.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:32 pm
Passwordless does not eliminate identity sprawl, it exposes it. The real constraint is not user adoption but architectural coherence across multiple IAM ecosystems. When authentication is distributed across IdPs, directories, and legacy application trust chains, passwordless becomes an overlay rather than a reset. Practitioners should treat the rollout as an estate integration programme, not a feature toggle.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between passwordless login and zero trust?
A: Passwordless login is an authentication method that removes passwords from the front door. Zero trust is a broader security model that continuously verifies identity, device posture, and access context across the session. A passwordless system can still fail zero trust expectations if it does not re-check risk after login or limit privilege tightly.
👉 Read our full editorial: Passwordless authentication is still constrained by IAM sprawl
This post was modified 4 days ago by NHI Mgmt Group