Topic starter
08/06/2026 4:24 pm
TL;DR: Passwordless authentication, phishing-resistant MFA, passkeys, and emerging standards such as AuthZEN and OID4VC are moving from early adoption to operational planning, according to OneSpan’s analysis of Gartner’s July 2025 Digital Identity Hype Cycle. The strategic shift is no longer whether these controls work, but how identity teams scale them without creating new integration, portability, and governance gaps.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Au-delà de l'absence de mot de passe : Préparer l'avenir de l'identité numérique”.
Key questions
Q: How should IAM teams govern passwordless identity without weakening assurance?
A: IAM teams should separate the convenience of passwordless login from the strength of identity proofing.
Q: Why do passkeys and phishing-resistant MFA still need governance oversight?
A: Because stronger authentication does not eliminate lifecycle risk.
Q: What breaks when organisations deploy passwordless login before fixing fallback flows?
A: The weakest recovery path becomes the new attack surface.
Practitioner guidance
- Map fallback authentication paths Identify every password reset, account recovery, help desk override and legacy federation path that can reintroduce weak authentication after passwordless adoption.
- Pilot passkeys in high-friction journeys Start with workforce and customer flows where phishing and password fatigue create the most risk, then measure recovery exceptions and support load.
- Test continuous authorisation assumptions Validate whether your application and policy stack can preserve assurance decisions beyond the initial login, especially where AuthZEN-style patterns are being considered.
Bottom line: Passwordless identity shifts IAM responsibility from protecting a reusable secret to governing trust across devices, recovery and federation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
08/06/2026 6:01 pm
Passwordless identity is becoming the new IAM control plane because the control problem has moved upstream. The old model treated authentication as a front-door event that could be solved with stronger factors. This article shows that the real issue is how identity assertions, device trust and portability are governed across the full access journey. Practitioners should stop treating passwordless as an endpoint and start treating it as the policy layer that coordinates access decisions.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between passwordless authentication and portable verifiable credentials?
A: Passwordless authentication changes how a user proves possession at login, while portable verifiable credentials change how trusted identity assertions can move between systems. One improves the login event, the other addresses reuse, portability and selective disclosure across ecosystems, which makes the governance problem broader than authentication alone.
👉 Read our full editorial: Passwordless identity is becoming the new IAM control plane
This post was modified 4 hours ago by NHI Mgmt Group