Topic starter
12/06/2026 10:22 pm
TL;DR: Passwordless adoption still stalls on credential sprawl, fragmented IAM platforms, and slow deprovisioning, with employees often managing more than 190 passwords and 10% or more retaining access after departure, according to Axiad. The real issue is not password removal alone, but whether identity programmes can consolidate lifecycle control across users, machines, and devices.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Moving to Passwordless Authentication, Part 2”.
By the numbers:
- Employees frequently have more than 190 different passwords to log into the applications and systems they use every day.
- 10% or more of employees can access their former employer’s data after leaving.
Key questions
Q: What fails when passwordless authentication is added to a fragmented IAM estate?
A: Credential management fails first.
Q: Why do passwordless programmes still need strong help desk controls?
A: Passwordless programmes still need strong help desk controls because recovery workflows often become the easiest way to defeat authentication.
Q: How do you know whether passwordless is actually reducing identity risk?
A: Look for fewer reusable secrets, lower help-desk volume for credential resets, and clear evidence that fallback access is rare and well documented.
Practitioner guidance
- Centralise credential governance Create one governed place for credential issuance, renewal, reset, and revocation so passwordless methods do not multiply control paths across platforms.
- Tie passwordless rollout to offboarding Require every passwordless workflow to prove that deprovisioning removes access across all systems before the user account is closed.
- Inventory user, machine, and device authenticators Map which identities are still authenticated through legacy passwords, FIDO, OTP, PKO, or other methods so you can remove inconsistent paths.
Bottom line: Passwordless authentication does not eliminate identity governance work, because the underlying problem is credential sprawl across systems and lifecycle steps.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:04 am
Passwordless does not reduce identity governance complexity by itself: It changes the authentication method, but the organisation still has to govern lifecycle, renewal, recovery, and offboarding across many systems. If the underlying IAM estate is fragmented, passwordless can simply relocate the sprawl instead of removing it. The real measure is whether identity control becomes more centralised and auditable, not whether passwords disappear.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations prioritise passwordless adoption or credential consolidation first?
A: Credential consolidation should come first when identities are already spread across several IAM systems. Passwordless reduces dependence on passwords, but it cannot remove the administrative burden of fragmented renewal, recovery, and offboarding. A single governance model makes the passwordless transition safer and easier to support at scale.
👉 Read our full editorial: Passwordless authentication challenges expose identity sprawl risk
This post was modified 6 days ago by NHI Mgmt Group