Notifications
Clear all
Topic starter
08/06/2026 4:47 pm
TL;DR: Passwords are finally losing ground as breach-driven credential markets, AI-enabled phishing, phishing-resistant authentication methods, and newer operational models make workforce password reliance increasingly untenable, according to Axiad’s analysis and cited CISA and Gartner guidance. The real shift is that authentication programmes now have workable alternatives that reduce both attack surface and administrative drag.
NHIMG editorial — based on content published by Axiad: Enough is Enough: 4 Reasons Passwords Will Be Flushed This Year
By the numbers:
- Over 80% of businesses use AI as core tech, and 65% regularly use generative AI in at least one business function.
- 9% of businesses are already using AI.
Questions worth separating out
Q: How should security teams replace workforce passwords without breaking access operations?
A: Security teams should replace passwords in stages, starting with the highest-risk access paths and pairing phishing-resistant factors with a credential lifecycle process.
Q: Why do passwords still create so much identity risk in enterprises?
A: Passwords create risk because they are reusable knowledge factors that can be stolen, replayed, and automated against at scale.
Q: How do organisations know if passwordless authentication is actually working?
A: Passwordless authentication is working when high-risk systems no longer depend on reusable secrets, recovery requests are controlled, and support can manage device or token replacement without forcing password fallback.
Practitioner guidance
- Prioritise phishing-resistant factors for high-risk workforce access Move the highest-value applications, administrative paths, and remote access use cases to FIDO or PKI-backed authentication before attempting broad password retirement.
- Build the credential lifecycle before expanding deployment Define issuance, preregistration, replacement, reset, and recovery workflows for hardware and certificate-based credentials so support does not become the bottleneck.
- Tie authentication design to device inventory and recovery Make token inventory, lost-device handling, and recovery state part of the IAM operating model so strong credentials remain usable at enterprise scale.
What's in the full article
Axiad's full blog post covers the operational detail this post intentionally leaves for the source:
- The vendor's examples of dark web credential markets and the way stolen passwords move into attacker workflows.
- The full discussion of phishing-resistant authentication methods such as FIDO passkeys, TLS certificates, and other possession factors.
- The Gartner-based operational efficiency angle for scaling hardware tokens, credential issuance, and resets across large workforces.
- The cited transportation-sector deployment example showing how a large enterprise rolled out strong authentication to 32,000 devices.
👉 Read Axiad's analysis of why workforce passwords are being phased out →
Passwordless workforce authentication: what changes for IAM teams?
Explore further
08/06/2026 6:36 pm
Password dependence has become an identity attack-surface problem, not just an authentication problem. Once credentials are widely traded, reused, and automated into phishing and stuffing workflows, the risk is no longer isolated login weakness. The broader failure is that password-based trust still assumes secrets remain stable and recoverable enough to function as a primary control, which no longer holds in modern enterprise conditions. Practitioners should treat password reduction as an identity surface reduction programme, not a UI change.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between phishing-resistant MFA and ordinary MFA?
A: Phishing-resistant MFA uses factors such as FIDO keys or PKI-backed credentials that bind authentication to possession, making interception and replay much harder. Ordinary MFA can still rely on weaker methods that are more exposed to phishing or token theft. The difference is whether the factor can survive a hostile login journey.
👉 Read our full editorial: Passwords are being displaced by stronger workforce authentication
