Topic starter
25/06/2026 12:58 am
TL;DR: Passwordless identity can reduce password reuse, phishing exposure, and day-to-day friction for field technicians, contractors, and maintenance crews in critical infrastructure, but RSA Security’s analysis makes clear that access still needs strong privilege controls, Zero Trust alignment, and continuous review. Eliminating passwords changes the authentication surface, not the governance burden.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “The Human Element: Passwordless Identity and Workforce Challenges for Critical Infrastructure”.
Key questions
Q: How should IAM teams govern passwordless identity without weakening assurance?
A: IAM teams should separate the convenience of passwordless login from the strength of identity proofing.
Q: Why is passwordless authentication not enough for zero trust by itself?
A: Passwordless authentication removes weak shared secrets, but it does not control session duration, privilege scope, or what happens after the login event.
Q: What breaks when organisations remove passwords but skip privilege reviews?
A: The identity programme starts to trust easier login while leaving entitlement sprawl untouched.
Practitioner guidance
- Define passwordless as an authentication control Map passkey, hardware-based, or biometric sign-in to the authentication layer and leave authorisation, entitlement modelling, and access review as separate programme workstreams.
- Apply risk-adaptive policy to privileged workforce sessions Use device posture, location, role, and session context to decide whether a passwordless login should receive standard or constrained access in operational environments.
- Review contractor and technician entitlements on a fixed cadence Prioritise accounts used by field staff, maintenance teams, and external contractors, because those identities often need elevated access for limited tasks and then retain it too long.
Bottom line: Passwordless improves sign-in security for critical infrastructure workers, but it does not change the need to govern who has access and how much.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:06 am
Passwordless identity is an authentication upgrade, not a governance reset: Removing passwords changes how workers prove who they are, but it does not change what they are allowed to do once inside. Critical infrastructure still depends on tightly governed access for field technicians, contractors, and maintenance crews, so the access model must be reviewed independently of the sign-in method. The practitioner lesson is to separate stronger authentication from stronger authorisation.
A few things that frame the scale:
- 74% of all breaches included the human element, through error, privilege misuse, stolen credentials or social engineering, according to Verizon's 2023 Data Breach Investigations Report.
A question worth separating out:
Q: What should IAM teams prioritise after passwordless becomes the default direction?
A: Prioritise recovery design, interoperability standards, and lifecycle governance. Passwordless changes the authentication surface, but it does not remove identity lifecycle risk. Teams that succeed will treat authentication as one part of a broader trust system covering enrolment, reauthentication, recovery, and revocation across the full user journey.
👉 Read our full editorial: Passwordless identity in critical infrastructure: what changes for IAM