Notifications
Clear all
Topic starter
08/06/2026 4:02 pm
TL;DR: As organisations shift remote work and privileged access flows away from passwords, Axiad argues that passwordless authentication must be designed around distinct personas, risk levels, and use cases, with alternatives such as biometrics, FIDO2, YubiKeys, and smart cards for different access paths. The real issue is not whether passwords are weak, but whether identity programmes still assume one-size-fits-all authentication.
NHIMG editorial — based on content published by Axiad: Forget your Password on World Password Day
By the numbers:
- More than 8 billion consumer records were breached in 2019, with a significant percentage exposing encrypted passwords.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations choose passwordless methods for different user types?
A: Choose methods by persona and risk, not by convenience or brand preference.
Q: Why do passwordless programmes still need strong identity governance?
A: Because removing passwords changes the login method, not the underlying governance problem.
Q: What mistakes do teams make when rolling out passwordless authentication?
A: The most common mistake is assuming one authentication pattern works for every persona.
Practitioner guidance
- Map personas before selecting authentication methods Document employees, contractors, administrators, systems, and machines separately, then assign each group a distinct authentication path based on access purpose and risk level.
- Reserve phishing-resistant methods for high-risk access Use biometrics, FIDO2, smart cards, or hardware tokens where the assurance requirement is high, especially for privileged users and remote access.
- Review recovery and enrolment flows as core controls Treat account recovery, device binding, and enrolment as part of the authentication design, because weaknesses there can undo the value of passwordless sign-in.
What's in the full article
Axiad's full blog post covers the practical authentication choices this post intentionally leaves at the strategy level:
- Specific examples of biometric, FIDO2, YubiKey, and smart card use cases for different user populations
- How the vendor recommends approaching adoption across employees, contractors, privileged users, and systems
- The article's framing for remote work authentication and user experience trade-offs
- Guidance on how organisations can think about rollout sequencing and user acceptance
👉 Read Axiad's blog post on passwordless authentication for human and machine access →
Passwordless authentication: what IAM teams need to rethink now?
Explore further
08/06/2026 5:25 pm
Passwordless is a human IAM modernisation problem, not a universal identity strategy. The article is strongest when it treats passwordless as a better fit for some personas and use cases than others. That is the correct governance lens because employees, administrators, contractors, and machines do not share the same assurance requirements. Practitioners should resist any rollout that erases those distinctions.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why identity modernisation has to include machine and workload governance.
A question worth separating out:
Q: How do passwordless controls affect machine and service access?
A: They can improve the overall identity model by forcing teams to classify subject type, access purpose, and risk, but they do not replace workload identity controls. Service accounts, API keys, and machine-to-machine flows still need lifecycle governance, secrets handling, and access scoping. Passwordless is a human-access strategy, not a substitute for NHI governance.
👉 Read our full editorial: Passwordless authentication exposes the limits of password-era IAM
