Topic starter
24/06/2026 9:24 pm
TL;DR: Hybrid workplaces are pushing authentication decisions beyond passwords toward MFA, biometrics, possession factors, and passwordless controls, with trade-offs around phishing resistance, usability, cost, and compliance according to 1Kosmos. The core security question is no longer whether to authenticate, but which mix of controls matches the risk, because weak first factors still shape the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Four Ways to Align Authentication with Business Needs”.
Key questions
Q: How should security teams choose between passwordless and MFA for workforce login?
A: They should not choose between them as if they were the same thing.
Q: When do possession or biometric factors make more sense than knowledge-based authentication?
A: They make more sense when the access path is sensitive enough that memory-based credentials are too easy to steal or guess, and when the organisation can support device issuance, privacy handling, and recovery processes.
Q: What are the biggest operational failures in passwordless rollouts?
A: The most common failures are weak recovery, inconsistent revocation, and fragmented administration across platforms.
Practitioner guidance
- Define authentication tiers by access risk Map low, medium, and high-risk access paths to different assurance levels, so users do not receive the same control set for a public resource and a sensitive system.
- Replace password-only entry points for sensitive access Remove standalone passwords from remote access, administrative functions, and regulated workflows where phishing or reuse would create outsized exposure.
- Evaluate possession and biometric factors for fit Check whether device loss handling, spoofing resistance, privacy requirements, and hardware compatibility are acceptable before standardising on one factor family.
Bottom line: Hybrid access changes authentication from a perimeter decision into a risk-based identity control decision.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:37 am
Hybrid authentication has become a control-selection problem, not a password problem. Once access spans office, cloud, and remote workflows, the control question shifts to which factor mix matches the sensitivity of the resource. That makes authentication design a governance decision about risk, not a user-preference exercise. Practitioners should treat the access path, not the login screen, as the unit of design.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Should organisations use the same authentication method for all users and use cases?
A: No, but they should use the same assurance standard where the risk is similar. Privileged access, sensitive applications, and remote access should share a phishing-resistant baseline, even if the form factor differs. Consistency matters more than one branded method, because fragmented exceptions create governance drift and a larger attack surface.
👉 Read our full editorial: Authentication control selection for hybrid access needs