Notifications
Clear all
Topic starter
02/08/2026 12:31 pm
TL;DR: Passwords remain weak against phishing, credential stuffing, SIM swapping and poor reuse habits, while MFA, biometrics, digital ID and risk-based checks reduce friction and raise assurance, according to Yoti. The governance issue is not just stronger login factors, but whether recovery, identity proofing and access policy are built for a world where passwords are no longer the trust anchor.
NHIMG editorial — based on content published by Yoti: modern authentication methods, biometrics and verified digital IDs
Questions worth separating out
Q: How should security teams implement stronger authentication for high-risk accounts?
A: Start by classifying accounts by impact, not by department.
Q: Why do passwords still create so much identity risk in modern environments?
A: Passwords remain risky because they are reusable, easy to phish, and often tied to inconsistent user behaviour across many accounts.
Q: What do organisations get wrong about biometrics and passwordless-style convenience?
A: They often assume convenience automatically means stronger security.
Practitioner guidance
- Strengthen high-risk login journeys Require MFA or passwordless options for accounts that can access personal data, financial records or administrative functions, and reserve password-only login for low-risk use cases.
- Harden account recovery flows Apply the same assurance standard to recovery as to initial authentication, including verified identity checks and fraud review for takeover-prone scenarios.
- Separate authentication factors by risk Use possession, inherence and contextual checks in combination, and avoid relying on one factor type where phishing or replay is likely.
What's in the full article
Yoti's full blog covers the operational detail this post intentionally leaves for the source:
- Specific authentication flows for MFA, biometrics and passwordless access across user journeys.
- Practical examples of risk-based authentication triggers and recovery design choices.
- Business-facing discussion of how verified digital IDs can support account recovery and trust.
- The article's own framing for regulated industries that need stronger login assurance.
👉 Read Yoti's blog on passwordless authentication, biometrics and verified digital ID →
Passwordless authentication and biometrics: are your controls keeping up?
Explore further
02/08/2026 1:29 pm
Password-only trust is a human identity control that has outlived its design assumptions. The article correctly frames passwords as a weak default, but the deeper issue is that reusable secrets were built for a lower-threat environment. Phishing, stuffing and SIM swapping now target the entire human authentication lifecycle, not just the login screen. Practitioners should treat password dependence as a structural governance problem, not a user training problem.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most identity programmes still lack complete machine identity coverage.
A question worth separating out:
Q: How do identity teams reduce account takeover risk without blocking normal users?
A: By focusing friction on trust-boundary changes and unusual behaviour instead of every login or purchase. ATO defence works best when teams revalidate sensitive changes, apply step-up checks to risky sessions, and keep routine flows low-friction for known-good users. The aim is selective verification, not blanket suspicion.
👉 Read our full editorial: Passwordless authentication is reshaping account security and trust
