Topic starter
24/06/2026 10:45 pm
TL;DR: Passwords are no longer the main problem in identity security, because attackers are moving into onboarding, recovery, service desk abuse, and AI-driven impersonation, according to HYPR research and echoing Gartner’s 2026 guidance on passwordless, contextual identity assurance. The real shift is from login security to continuous verification across the identity lifecycle, where static MFA and point-in-time trust no longer hold.
Editorial analysis by NHI Mgmt Group, based on content published by HYPR: “The 2026 CISO Mandate: Proactive, Passwordless, and Context-Aware Identity Assurance”.
Key questions
Q: How should security teams implement passwordless authentication without creating new recovery risk?
A: Security teams should remove passwords from both primary login and recovery paths, then require stronger proofing for reset workflows than for normal sign-in.
Q: Why do service desks remain a high-risk path for identity compromise?
A: Because many support workflows still rely on conversational trust, fallback verification, or inconsistent exception handling.
Q: What are the signs that identity assurance is still point-in-time only?
A: The main signs are weak recovery options, manual approval steps, inconsistent verification between onboarding and account recovery, and no use of contextual signals when risk increases.
Practitioner guidance
- Eliminate password dependence across the access stack Remove shared secrets from login, recovery and administrative workflows so that passwordless access is not undermined by fallback authentication paths.
- Embed verification into onboarding and recovery Require deterministic identity verification at onboarding, account recovery and privilege elevation, not only at the initial sign-in step.
- Automate service desk validation Replace security questions and manual judgment calls with policy-driven validation that can be applied consistently under pressure.
Bottom line: Passwordless access lowers credential abuse, but it does not by itself secure the identity lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:34 am
Lifecycle trust is now the real control plane for passwordless identity. Passwordless authentication removes a class of credential risk, but it does not solve the governance problem of deciding when a human is genuinely who they claim to be. The important shift is from protecting the login screen to governing every trust-bearing step in the identity lifecycle. Practitioners should treat onboarding, recovery and privilege elevation as first-class security controls, not support functions.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What should identity teams do when trust decisions are delegated to humans?
A: They should remove human discretion wherever a workflow can be standardised. Human review is not reliable when attackers target support channels, recovery paths or privilege changes. The safer pattern is policy-driven validation that decides consistently and leaves less room for social engineering.
👉 Read our full editorial: Passwordless identity assurance now depends on lifecycle trust