Topic starter
02/01/2026 11:31 am
TL;DR: Critical infrastructure operators are being pushed toward passwordless identity, risk-adaptive authentication, and certificate-based trust as the practical foundation for Zero Trust across IT, OT, and mobile workforces, according to RSA Security. The governance issue is no longer whether passwordless is desirable, but whether identity controls can sustain continuous verification under NIS2, ransomware pressure, and supply-chain risk.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “NIS2, Identity, IT, and OT: Stay Operational, Stay Resilient”.
Key questions
Q: What breaks when critical access still depends on passwords in a Zero Trust model?
A: Passwords preserve a reusable secret that attackers can phish, brute-force, or replay, which undermines continuous verification.
Q: Why do risk-adaptive authentication controls matter more in OT and critical services?
A: Because the same identity can behave differently depending on device posture, location, role, and whether the request touches an operational or business system.
Q: Should organisations prioritise passwordless or identity verification first?
A: They should treat them as complementary controls rather than competing projects.
Practitioner guidance
- Define passwordless coverage for critical access paths Map which remote access, privileged admin, SCADA-adjacent, and mobile access paths still depend on passwords, then prioritise the highest-consequence ones for replacement first.
- Tighten risk signals for adaptive authentication Choose the device, location, role, and session signals that should raise or lower trust for each critical service, and document them before enabling policy automation.
- Treat certificates as governed identity assets Assign clear ownership, expiry, and revocation responsibilities for certificate-based identity so that cryptographic trust does not outlive the systems and users it protects.
Bottom line: Passwords remain the most fragile part of Zero Trust when critical services still depend on reusable secrets for remote and operational access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 4:06 am
Passwordless identity is now the control boundary Zero Trust depends on. When passwords remain the primary authenticator, the Zero Trust model still inherits a reusable-secret failure mode that attackers already know how to exploit. In critical infrastructure, that weakness is amplified by OT, SCADA, remote operations, and mobile access patterns. The practical conclusion is that identity assurance must shift from shared secrets to cryptographic trust.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between certificate-based authentication and password-only login?
A: Certificate-based authentication uses a digital certificate and private key to prove identity, while password-only login depends on a memorized secret. Certificates can authenticate both the user and the machine, and they support mutual authentication. Password-only methods are easier to misuse or steal, which is why certificate-based authentication is often used as a stronger layer for network and application access.
👉 Read our full editorial: Passwordless identity is now central to Zero Trust resilience