Topic starter
25/06/2026 12:48 am
TL;DR: A major US bank used hybrid passwordless authentication across Windows, Mac, remote, third-party, and BYOD users to strengthen access security and compliance while preserving legacy app access, according to RSA Security. The case shows that passwordless only reduces risk when it is paired with device-aware controls, legacy coverage, and identity governance.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Large US Bank Adopts Hybrid Passwordless Authentication to Transform Identity Security with RSA and Microsoft”.
Key questions
A: They should treat it as an access-architecture programme, not a single authentication setting.
Q: What do organisations get wrong about passwordless rollout in hybrid environments?
A: They often focus on the sign-in method and ignore the surrounding controls.
Q: What breaks when authentication stops at login?
A: Login-only controls can confirm who entered, but they cannot prove the same identity still controls the session after access is granted.
Practitioner guidance
- Map every password fallback path Identify legacy applications, break-glass access, and exception processes that still depend on passwords, cached credentials, or one-off workarounds.
- Extend device trust into authentication policy Require device posture, managed status, and mobile protection signals before allowing passwordless access from BYOD and remote endpoints.
- Separate third-party access from internal trust assumptions Apply distinct policy, monitoring, and revocation processes to contractor and supplier identities rather than inheriting employee access patterns.
Bottom line: Hybrid passwordless reduces reliance on reusable credentials, but it does not remove the need to govern legacy paths, third parties, and device trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:49 am
Hybrid passwordless is an identity governance problem, not just an authentication project. The bank’s use case spans managed endpoints, remote work, third parties, BYOD, and legacy applications, which means the control boundary is the full access lifecycle rather than a single login screen. That is where most programmes fail: they modernise the front door but leave inconsistent policy behind it. The practitioner conclusion is that passwordless only counts when the whole access path is governed.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between passwordless and stronger identity governance?
A: Passwordless changes how users authenticate, but it does not by itself govern who should have access, when access should be removed, or how exceptions are managed. Strong identity governance covers entitlement lifecycle, policy enforcement, and continuous visibility. In practice, passwordless is one control inside a broader governance model.
👉 Read our full editorial: Hybrid passwordless authentication raises the bar for identity security