Notifications
Clear all
Topic starter
24/06/2026 9:42 pm
TL;DR: Passwordless IAM removes password-centric attack paths and replaces them with biometrics, hardware tokens, and device-based verification, according to 1Kosmos. The security gain is real, but the governance problem shifts to proofing quality, fallback controls, auditability, and lifecycle management across user populations.
NHIMG editorial — based on content published by 1Kosmos: Passwordless IAM and secure identity verification
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should organisations govern passwordless authentication recovery paths?
A: Organisations should govern recovery paths as privileged access, not as convenience features.
Q: Why do passwordless programmes still need access reviews?
A: Passwordless programmes still need access reviews because the organisation is managing factors, devices, and recovery channels, not just passwords.
Q: What do security teams get wrong about passwordless IAM?
A: Teams often assume that removing the password removes the governance burden.
Practitioner guidance
- Map passwordless recovery as a high-risk access path Document every fallback route, including help desk resets, secondary devices, and temporary codes.
- Bind factor revocation to joiner-mover-leaver processes Treat hardware tokens, biometrics, and device registrations as lifecycle objects that must be removed when users change role or leave the organisation.
- Separate proofing from authentication policy Use stronger identity proofing for enrollment and keep authentication policy distinct from the method used to verify a user at runtime.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanation of the passwordless enrollment flow across biometrics, hardware tokens, and mobile verification.
- Implementation considerations for moving from password-based authentication to passwordless IAM in existing environments.
- Regulatory and compliance discussion covering audit trails, identity proofing, and secure access records.
- Practical notes on user education, compatibility, and transition planning for phased rollout.
👉 Read 1Kosmos's article on passwordless IAM and secure identity verification →
Passwordless IAM and MFA replacement: what changes for identity teams?
Explore further
25/06/2026 6:45 am
Passwordless IAM does not remove identity risk, it relocates it. The password was only one weak link in the access chain. Once it is removed, the decisive controls become identity proofing, factor lifecycle, recovery governance, and auditability. Practitioners should read passwordless as a control shift, not a control finish line.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, according to Ultimate Guide to NHIs, which shows how slowly identity remediation can lag behind discovery.
A question worth separating out:
Q: How do you know if passwordless IAM is actually working?
A: Passwordless IAM is working when phishing resistance improves, recovery events are rare and well-controlled, and factor revocation is consistently tied to lifecycle events. If support resets, alternate devices, or bypass routes are rising, the programme is likely masking weak assurance rather than reducing it.
👉 Read our full editorial: Passwordless IAM shifts the control problem from secrets to proof
