Notifications
Clear all
08/06/2026 5:33 pm
Mobile credentials reduce friction, but they do not collapse the need for differentiated assurance. The article makes clear that some users and environments still require physical or higher-assurance credentials. That means the real governance problem is tiering access by risk, not standardising everyone onto a single factor. Practitioners should expect credential diversity to persist, especially for high-privilege roles and restricted facilities.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity control breaks down before remediation can begin.
A question worth separating out:
Q: How should teams handle offline access for mobile credential programmes?
A: They should design and test a separate authentication path before rollout, not after outages expose the gap. The fallback path should preserve identity assurance, align with workstation and application needs, and be governed as part of the same credential lifecycle so recovery does not become an unmanaged exception.
👉 Read our full editorial: Mobile credentials improve authentication, but they do not fit all
