Notifications
Clear all
Topic starter
11/07/2026 8:36 pm
TL;DR: Passwordless and Zero Trust programmes still depend on lifecycle control, reporting discipline, and measurable governance foundations, not just authentication modernisation, according to Versasec. Versasec’s chairman frames the company’s growth around replacing passwords, disciplined execution, and scalable credential management for smart cards, virtual smart cards, and certificates.
NHIMG editorial — based on content published by Versasec: A Chairman's Perspective: Torvald Bohlin on Building Versasec
By the numbers:
- Torvald Bohlin says he has nearly 45 years of experience across executive roles in business, telecom, media, IT, and financial services.
Questions worth separating out
Q: How should organisations govern passwordless credentials at enterprise scale?
A: Treat passwordless credentials as governed identity assets, not convenience features.
Q: Why do Zero Trust programmes still depend on credential management?
A: Zero Trust depends on continuous verification, and verification is only as strong as the credential lifecycle behind it.
Q: What do IAM teams get wrong about passwordless migration?
A: They often focus on login replacement and underinvest in the operational model behind it.
Practitioner guidance
- Map every credential type in scope Inventory smart cards, virtual smart cards, and software certificates separately so issuance and revocation rules match the actual credential class.
- Tie passwordless rollout to lifecycle controls Require issuance, renewal, and revocation workflows to be defined before expanding passwordless use.
- Validate audit evidence early Check that the credential platform can produce records suitable for internal audit, external certification, and compliance review.
What's in the full article
Versasec's full post covers the leadership and product context this analysis intentionally leaves for the source:
- The interview’s full discussion of how the chairman approached company scaling, investor confidence, and operational discipline
- Versasec’s description of vSEC:CMS as a credential management system for issuing, managing, and controlling digital credentials
- The product framing around vSEC:CLOUD deployment in a virtual private cloud with customer separation
- The company’s own explanation of how its credential management approach supports phishing-resistant MFA and Zero Trust
👉 Read Versasec's perspective on scaling credential management for passwordless identity →
Passwordless credential strategy at scale: what IAM teams should assess?
Explore further
11/07/2026 9:04 pm
Credential management is the real control plane behind passwordless identity. Replacing passwords only changes the front door if issuance, renewal, and revocation remain governed. The article makes clear that credentials still exist in multiple forms, and that operational maturity is what turns a passwordless idea into an enterprise control surface. Practitioners should treat credential lifecycle design as the primary security decision, not a back-office function.
Credential programmes are now judged by recoverability, not just issuance quality. If a platform can create credentials faster than teams can revoke and evidence them, passwordless becomes a governance liability. The programme should be designed around lifecycle visibility, especially where certificates and smart cards are being used as part of Zero Trust.
A question worth separating out:
Q: How can security teams tell whether credential governance is mature enough?
A: Look for measurable controls, not claims of modernisation. Mature governance can show where credentials are issued, who owns them, how they are revoked, and whether those actions are visible to audit and compliance stakeholders. If the programme cannot produce that evidence, it is not yet operating as a governed identity system.
👉 Read our full editorial: Credential strategy and passwordless scale: Versasec's leadership lens
