Topic starter
12/06/2026 10:12 pm
TL;DR: FIDO2 improves user authentication, but it does not cover machine identities, email signing, or document signing, making PKI the missing complement for broader identity protection, according to Axiad. The real issue is that passwordless authentication solves one layer of identity risk while leaving machine and interaction trust unresolved.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “PKI and FIDO2: The Dynamic Duo of Authentication”.
By the numbers:
- 90% of IT leaders have seen an increase in cyberattacks since the transition to remote work.
- 87% of large organizations already have adopted MFA solutions.
- 75% of IT leaders plan to increase MFA spending in the next year.
Key questions
Q: How should security teams combine FIDO2 and PKI without creating overlap?
A: Use FIDO2 for strong human authentication and PKI for machine identities, email signing, encryption, and document trust.
Q: What breaks if an organisation tries to replace all authentication with FIDO?
A: Machine and device use cases can be left without a practical identity control because FIDO is designed primarily for interactive user authentication.
Q: Why do passwordless programmes still need strong lifecycle governance?
A: Passwordless shifts risk from passwords to issuance, recovery, and revocation.
Practitioner guidance
- Define authentication scope by identity type Separate human login, machine authentication, email trust, and document signing into distinct governance scopes before selecting controls.
- Use PKI for non-interactive trust Issue certificates for devices, applications, signed messages, and signed documents where a user-present flow is not appropriate.
- Inventory machine identities and certificate owners Maintain ownership, renewal responsibility, and revocation paths for devices, applications, and service identities that depend on certificates.
Bottom line: FIDO2 strengthens user authentication, but it does not by itself secure machines, email, or documents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:50 am
PKI and FIDO2 solve different trust problems, not competing versions of the same problem. FIDO2 hardens interactive user authentication, while PKI governs device, message, and document trust. IAM programmes that treat them as substitutes usually optimise one control path and leave adjacent identity surfaces exposed. The practical conclusion is that authentication architecture should be segmented by subject, not by vendor preference.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: What is the difference between human authentication and machine identity trust?
A: Human authentication proves a person is present and can complete a login flow, while machine identity trust proves a device, application, or service is authorised to participate in a transaction. They require different controls, different lifecycle management, and different failure handling. Conflating them is how identity programmes leave non-human access ungoverned.
👉 Read our full editorial: PKI and FIDO2 together close authentication gaps