Topic starter
08/06/2026 4:03 pm
TL;DR: A survey of 252 U.S. security and IT executives found that 86% plan to implement passwordless authentication within 12 months or already have, but 70% are overwhelmed by authentication complexity and 42% cite lack of visibility across practices, according to Axiad. Passwordless only reduces risk when identity architecture, governance, and user experience are aligned.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Don’t Let Underlying IT Complexity Block Your Road to Successful Authentication”.
By the numbers:
- The survey covered 252 U.S. security and IT executives at organisations with 2,500 or more employees.
- 86% said they plan to implement a passwordless strategy in the next 12 months, or already have done so.
- 70% said they are overwhelmed by the complexity of their authentication systems.
Key questions
Q: What breaks when users rely on mixed authentication methods during a passwordless transition?
A: Mixed authentication can create uneven security, inconsistent user experience, and support complexity if different groups use different sign-in paths without clear policy.
Q: Why does poor visibility across authentication practices increase security risk?
A: Poor visibility prevents teams from seeing where authentication methods are actually used, which makes policy drift invisible and exceptions hard to retire.
Q: How should security teams reduce passwordless friction without weakening control?
A: Security teams should simplify enrolment, recovery, and device replacement so the approved path is the easiest path.
Practitioner guidance
- Map every authentication path Document primary login methods, recovery flows, fallback options and application exceptions so the full authentication estate is visible before any migration.
- Rationalise fragmented silos Consolidate duplicated identity provider paths and local authentication workarounds that keep passwords or weaker methods in place.
- Reduce end-user bypass pressure Remove repeated prompts and unnecessary steps in high-friction journeys so users are less likely to circumvent controls.
Bottom line: Authentication complexity, not demand, is the main reason passwordless adoption remains difficult in many enterprises.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:27 pm
Authentication complexity is the real blocker, not passwordless itself: the survey shows demand is already there, but the estate underneath is too fragmented to absorb a clean transition. Passwordless only works when the organisation can govern every authentication path, including recovery, fallback and exception handling. The practitioner takeaway is that adoption plans must start with rationalisation, not branding.
A question worth separating out:
Q: How should IAM teams sequence a passwordless rollout in complex environments?
A: Start by rationalising authentication paths, then standardise policy and recovery, and only then expand rollout across applications and user groups. A passwordless programme that begins with deployment often inherits the very complexity it was meant to remove. Sequencing matters because governance has to catch up with architecture.
👉 Read our full editorial: Authentication complexity is blocking passwordless adoption, survey finds
This post was modified 4 days ago by NHI Mgmt Group