Topic starter
10/07/2026 9:11 pm
TL;DR: Passwordless authentication can reduce resets and improve user experience, but passwords remain embedded in legacy systems and exposed credentials continue to authenticate access, according to Enzoic. The governance problem is not the end of passwords, but the long tail of credential reuse and breach-driven exposure that identity teams still have to manage.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Password Retirement Is Premature”.
Key questions
Q: What should organisations do first when building a passwordless authentication programme?
A: The first step is to map the current environment and user population before choosing a control.
Q: Why do passwordless programmes still get compromised through recovery paths?
A: Because passwordless improves the login step, not every way identity is re-established.
Q: How do teams know if passwordless is actually reducing identity risk?
A: Look for fewer password-reset events, fewer help-desk recovery cases, and tighter policy enforcement across managed devices and high-risk apps.
Practitioner guidance
- Map residual password dependencies Inventory every system, workflow, and recovery process that still accepts username-and-password authentication, including legacy apps and vendor portals.
- Remove credential reuse from the estate Enforce unique credentials where passwords remain unavoidable, and target reused passwords in accounts that can still reach critical business systems.
- Harden account recovery paths Review password reset, break-glass, and help desk recovery processes so they do not become the easiest way back into a passwordless environment.
Bottom line: Passwordless authentication reduces dependency on passwords but does not remove the authentication risk created by legacy and fallback paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:34 pm
Credential retirement fails when the authentication chain still trusts old secrets: Passwordless adoption does not end risk if passwords remain valid anywhere in the estate. The real control issue is not whether a password exists, but whether a breached password can still be redeemed through a legacy, recovery, or third-party path. Practitioners should treat password retirement as an authentication-chain problem, not a branding exercise.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations retire passwords before every legacy system is modernised?
A: No. If critical systems still depend on passwords, a forced retirement can create access outages and unmanaged exceptions. A better approach is to contain the remaining password surface, reduce reuse, and migrate the highest-risk authentication paths first while maintaining business continuity.
👉 Read our full editorial: Password retirement is premature because credential exposure persists