Notifications
Clear all
Topic starter
12/06/2026 10:22 pm
TL;DR: Passwordless adoption still stalls on credential sprawl, fragmented IAM platforms, and slow deprovisioning, with employees often managing more than 190 passwords and 10% or more retaining access after departure, according to Axiad. The real issue is not password removal alone, but whether identity programmes can consolidate lifecycle control across users, machines, and devices.
NHIMG editorial — based on content published by Axiad: Authentication Moving to Passwordless Authentication, Part 2
By the numbers:
- Employees frequently have more than 190 different passwords to log into the applications and systems they use every day.
- Studies show that 10% or more of employees can access their former employer's data after leaving.
Questions worth separating out
Q: What breaks when passwordless authentication is added without lifecycle governance?
A: The programme becomes harder to manage, not easier, because credentials still exist in the form of tokens, keys, recovery factors, and device registrations.
Q: Why do passwordless programmes still struggle with access risk?
A: Because the risk moves from password reuse to credential sprawl and lifecycle gaps.
Q: How do teams know whether passwordless is actually improving security?
A: Look for evidence that offboarding is complete, recovery is controlled, and every authenticator is visible in one governance system.
Practitioner guidance
- Map every passwordless authenticator to a lifecycle owner Document who is responsible for issuance, renewal, recovery, and revocation for each FIDO key, token, device credential, and fallback factor.
- Audit offboarding for alternate access paths Test whether disabling a user account also removes registered devices, recovery factors, and any secondary authenticators tied to that identity.
- Consolidate credential management around one authoritative system Reduce the number of IAM platforms that can issue or manage authenticators, then connect the remaining platform to help desk, provisioning, and recertification workflows.
What's in the full article
Axiad's full blog covers the operational detail this post intentionally leaves for the source:
- The article's step-by-step breakdown of why passwordless adoption gets stuck in real IAM environments
- The specific user and help desk friction points that slow renewals, resets, and recovery
- The source author's discussion of how consolidating credentials management changes the end-user experience
- The vendor's own examples of integrating existing credentials into a single passwordless platform
👉 Read Axiad's analysis of the challenges in moving to passwordless authentication →
Passwordless authentication: the governance gap teams are missing?
Explore further
13/06/2026 1:04 am
Passwordless success depends on lifecycle control, not factor novelty. The article shows that removing passwords does not remove identity risk when credentials are still fragmented across systems. The real governance challenge is whether organisations can issue, renew, and revoke every authenticator through a consistent lifecycle model. Practitioners should read passwordless as an identity governance programme, not a point solution.
Credential consolidation will become a governance test, not a convenience metric. Passwordless deployments that reduce user friction but leave recovery, revocation, and offboarding fragmented will not materially improve security posture. Teams should expect more scrutiny on whether their identity platforms can prove complete lifecycle control across people and machines.
A question worth separating out:
Q: Who is accountable when a former employee still has access after offboarding?
A: Accountability sits with the identity and access governance function, but the failure often spans HR, IAM, help desk, and application owners. If passwordless credentials are not tied to a clear deprovisioning workflow, the organisation cannot prove that access ended when employment ended.
👉 Read our full editorial: Passwordless authentication challenges expose identity sprawl risk
