Topic starter
11/07/2026 8:36 pm
TL;DR: Passwordless and Zero Trust programmes still depend on lifecycle control, reporting discipline, and measurable governance foundations, not just authentication modernisation, according to Versasec. Versasec’s chairman frames the company’s growth around replacing passwords, disciplined execution, and scalable credential management for smart cards, virtual smart cards, and certificates.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “A Chairman's Perspective: Torvald Bohlin on Building Versasec”.
Key questions
Q: What breaks when passwordless authentication is deployed without lifecycle controls?
A: The organisation can no longer tell whether an authenticator is still valid, who controls it, or whether it should still grant access.
Q: Why do passwordless programmes still need audit-ready reporting?
A: Because auditors and leadership need evidence that the programme is controlled, not just implemented.
Q: What signs show a credential strategy is not yet ready to scale?
A: Manual reporting, unclear ownership, inconsistent revocation, and weak visibility into credential status are all signs that scale will be painful.
Practitioner guidance
- Define credential lifecycle ownership Assign clear responsibility for issuance, renewal, suspension, and revocation across smart cards, virtual smart cards, and certificates so passwordless does not become unmanaged access sprawl.
- Instrument reporting for lifecycle evidence Track how many credentials are active, expired, pending renewal, or revoked, and make those figures available to security, audit, and leadership stakeholders.
- Align passwordless rollout with Zero Trust assumptions Verify that the governance model can continuously validate credentials rather than relying on a one-time deployment decision.
Bottom line: Passwordless removes passwords from the user experience, but it does not remove the credential governance burden behind access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:04 pm
Credential strategy fails when organisations treat passwordless as an authentication project rather than a governance model. The article is clear that the harder work is not eliminating passwords, but building the control fabric around smart cards, virtual smart cards, and certificates. That is a lifecycle problem as much as an access problem. Practitioners should read this as a warning that access modernisation without credential governance simply relocates the risk.
A question worth separating out:
Q: How can security teams compare passwordless IAM with zero trust?
A: Passwordless answers how a subject proves identity, while zero trust answers how that identity is continuously evaluated for access. They are complementary, not interchangeable. Organisations should use passwordless to strengthen authentication and zero trust to enforce ongoing authorization, session control, and least privilege.
👉 Read our full editorial: Credential strategy and passwordless scale: Versasec's leadership lens