Topic starter
25/06/2026 1:07 am
TL;DR: Critical infrastructure access still breaks down around reusable passwords; RSA Security argues NIS2 makes that risk harder to ignore in regulated environments. Third-party logins need stronger assurance than static credentials can provide across suppliers, contractors, and legacy systems.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Securing Europe’s Critical Infrastructure in the NIS2 Era: Why Passwordless Identity Security Matters”.
Key questions
Q: Why do passwords create more risk in supplier and contractor access?
A: Suppliers and contractors often need access from different devices, locations, and lifecycle states than employees, yet password-based governance treats them as if they were the same.
Q: When should organisations prioritise pilot groups and early adopters in a passwordless rollout?
A: They should do it at the start, before broad deployment.
Q: What breaks when critical infrastructure still relies on passwords under NIS2?
A: Reusable passwords leave critical infrastructure exposed to phishing, reuse, and credential interception, so the access decision can be defeated before the user reaches the application.
Practitioner guidance
- Map critical access paths to password exposure Identify which operational accounts, supplier logins, and contractor pathways still depend on reusable passwords, then rank them by business criticality and exposure to phishing or reuse.
- Phase in phishing-resistant authentication Prioritise FIDO2 hardware keys, mobile biometrics, or equivalent phishing-resistant methods for privileged and high-impact access before expanding to lower-risk workflows.
- Separate third-party access governance Apply distinct enrolment, recovery, and assurance rules for suppliers and contractors so their access does not inherit employee assumptions about device trust or lifecycle handling.
Bottom line: Password-based access remains a poor fit for regulated critical infrastructure because it is easy to phish, reuse, and scale into disruption.
Glossary terms: Passwordless Identity Assurance, Phishing-Resistant Authentication, Zero Trust
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:19 am
Password reliance is now an access-governance liability in critical infrastructure. NIS2 pushes the control discussion beyond login convenience and into resilience, because passwords are both human-dependent and easy to abuse at scale. In regulated sectors, that makes them a poor foundation for high-impact access paths. The practitioner conclusion is straightforward: if the access model still depends on reusable secrets, the governance model is already behind the regulatory demand.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Why do remote workforce environments increase the need for Zero Trust and passwordless access?
A: Remote work expands the number of devices, applications, and third parties that must be trusted across distributed environments. That increases exposure if access decisions rely on static credentials or fragmented controls. Zero Trust and passwordless approaches reduce dependency on passwords, limit implicit trust, and help organizations verify users more consistently across cloud and remote access paths.
👉 Read our full editorial: Passwordless identity security for NIS2 critical infrastructure access