Topic starter
06/06/2026 11:10 am
TL;DR: Passwordless authentication is gaining momentum because FIDO-style passkeys and cryptographic credentials can reduce phishing risk, password resets, and user friction while improving sign-in success, according to Imprivata. The IAM question is no longer whether passwords are weak, but how to migrate identity controls without breaking workflow, assurance, or lifecycle governance.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “FIDO Alliance and passwordless authentication: Imprivata joins the FIDO Alliance to revolutionize security”.
By the numbers:
- Most end users have an average of 100 online accounts.
- 77% of hacking incidents involve stolen credentials.
- In 2025, the average cost of a data breach in the U.S. was $4.4 million.
Key questions
Q: How should IAM teams implement passwordless authentication without breaking customer journeys?
A: Start with hybrid deployment in new or low-risk flows, then expand to existing journeys once recovery, fallback, and step-up rules are proven.
Q: Why do passwords still persist even when organisations know they are risky?
A: Passwords persist because migration is operationally hard, not because the risk is unclear.
Q: What are the signs that password-only authentication is failing in practice?
A: Password-only authentication is failing when a valid password is enough to grant access from an unusual place, device, or time without any additional checks.
Practitioner guidance
- Map authentication methods to assurance levels Separate low-risk sign-in, step-up authentication and privileged access so that passwordless is introduced where the assurance model is already clear.
- Design authenticator recovery paths Define how users recover access after device loss, authenticator replacement or enrolment failure before broad rollout starts.
- Track reset and abandonment rates Use password reset volume, failed sign-in rates and abandonment trends to identify where the current authentication flow is creating avoidable friction.
Bottom line: Passwordless authentication addresses both phishing risk and the operational drag created by reusable passwords, but it shifts governance to authenticator enrolment and recovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:48 am
Passwordless authentication is best understood as a control-model shift, not a UX upgrade. Moving from passwords to passkeys changes the trust anchor from something a user remembers to something a device or authenticator proves cryptographically. That matters because IAM governance must now account for authenticator state, attestation and recovery, not only user enrolment. The practitioner conclusion is simple: treat passwordless as an identity architecture decision, not a front-end convenience feature.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What should organisations compare when evaluating passkeys versus MFA?
A: Compare assurance, recovery complexity and user friction rather than treating them as competing brands of the same control. Passkeys can remove shared secrets, while MFA adds layered verification. The better choice depends on whether the main problem is phishing exposure, workflow friction or privileged access assurance.
👉 Read our full editorial: Passwordless authentication and FIDO Alliance governance for IAM teams