Topic starter
12/06/2026 10:07 pm
TL;DR: As organisations move away from passwords, the real challenge is not just replacing one factor with another but mapping personas, access paths, and risk levels across employees, contractors, administrators, systems, and machines, according to Axiad. Passwordless works only when identity governance covers the full user population, not just people.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Forget your Password on World Password Day”.
Key questions
Q: How should organisations decide which users can move to passwordless first?
A: Start with personas and use cases, not with a blanket policy.
Q: Why do passwordless programmes need to include systems and machines?
A: Because modern identity estates are not limited to people.
Q: What breaks when privileged access is bundled into everyday user accounts?
A: Auditability, separation of duties, and blast-radius control all weaken when standard and privileged access are merged.
Practitioner guidance
- Map every identity persona before rollout Classify employees, contractors, administrators, systems, and machines separately, then document the access patterns and assurance level each one requires.
- Split human and non-human authentication design Do not force systems and machines into the same authentication model used for people; define a separate governance path for non-human identities.
- Review privileged use cases independently Treat administrative access as a distinct risk class and validate whether passwordless controls still preserve oversight, separation of duties, and recovery options.
Bottom line: Passwordless authentication is not a complete security strategy unless the identity model distinguishes personas, privileges, and access contexts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:41 am
Persona-based identity risk review is the real control boundary for passwordless programmes. Passwordless removes passwords from the workflow, but it does not remove the need to classify access by role, trust level, and operational impact. The governance failure appears when organisations assume one authentication pattern can safely cover all identities. The practitioner conclusion is simple: passwordless only becomes defensible when the risk model is built around personas, not login convenience.
A question worth separating out:
Q: What is the difference between passwordless and stronger identity governance?
A: Passwordless changes how users authenticate, but it does not by itself govern who should have access, when access should be removed, or how exceptions are managed. Strong identity governance covers entitlement lifecycle, policy enforcement, and continuous visibility. In practice, passwordless is one control inside a broader governance model.
👉 Read our full editorial: Passwordless authentication needs persona-based identity risk review