Notifications
Clear all
Topic starter
12/06/2026 10:12 pm
TL;DR: Passwordless orchestration is framed as an integrated authentication approach that can unify siloed visibility and automate key actions while reducing phishing friction, according to Axiad. The governance issue is not passwordless alone, but whether authentication programmes can enforce consistent policy across fragmented identity stacks, with the vendor emphasizing phishing-resistant MFA and holistic control across information silos.
NHIMG editorial — based on content published by Axiad: organization-wide passwordless orchestration
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
Questions worth separating out
Q: How should security teams govern passwordless authentication across multiple systems?
A: They should treat passwordless as an orchestration problem, not a point-product rollout.
Q: Why do fragmented authentication tools create risk for IAM programmes?
A: Fragmented tools create risk because policy, telemetry, and remediation are split across systems that do not share a full identity context.
Q: What do teams get wrong about phishing-resistant MFA?
A: They often assume the factor alone solves the problem.
Practitioner guidance
- Consolidate authentication policy ownership Map every login, step-up, and exception path to a single accountable policy authority so local product settings do not create hidden assurance gaps.
- Prioritise phishing-resistant methods for high-risk access Make phishing-resistant MFA the default for privileged users, remote access, and sensitive workflows where credential replay risk is highest.
- Audit authentication exceptions and fallback paths Review where passwordless or strong MFA silently falls back to weaker methods, and remove exceptions that weaken assurance consistency across channels.
What's in the full article
Axiad's full blog post covers the interview detail this post intentionally leaves for the source:
- The discussion with Joe Garber on moving from fragmented authentication to an integrated approach.
- The vendor's explanation of why not all MFA solutions are equal in practice.
- The interview segment on how phishing-resistant MFA can reduce friction while improving security.
- The original podcast context and video assets for teams that want the source conversation in full.
👉 Read Axiad's interview on organisation-wide passwordless orchestration →
Passwordless orchestration: what integrated authentication changes for IAM?
Explore further
13/06/2026 12:48 am
Integrated authentication, not isolated login controls, is the real governance object. The article’s core message is that authentication sprawl creates inconsistent policy enforcement and incomplete visibility. That is a governance failure, because risk decisions are being made in separate tools that cannot see the whole identity journey. Practitioners should therefore assess authentication as an estate-wide control plane, not a set of standalone features.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity control breaks before teams can enforce consistent authentication governance.
A question worth separating out:
Q: How do organisations know if passwordless orchestration is working?
A: It is working when authentication decisions are consistent, auditable, and aligned to access risk across the whole estate. Teams should look for fewer local exceptions, clearer step-up logic, and a single source of truth for assurance events. If logs must be stitched together, orchestration is still incomplete.
👉 Read our full editorial: Passwordless orchestration points to integrated authentication governance
