Topic starter
16/01/2026 5:10 pm
TL;DR: As cloud and hybrid infrastructure expand, legacy passwords and PINs remain vulnerable to reuse, phishing, weak secrets, and social engineering, while StrongDM frames MFA, JIT access, passkeys, passwordless, continuous, and adaptive authentication as the modern alternatives. The security question is no longer whether authentication exists, but whether it is contextual, ephemeral, and continuously enforced across NHI-heavy environments.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “9 User Authentication Methods to Stay Secure in 2026”.
Key questions
Q: When should teams replace password-only authentication with MFA or passkeys?
A: Teams should move away from password-only authentication when the account protects sensitive data, administrative functions, or privileged infrastructure.
Q: Why do continuous authentication checks matter after login?
A: Because many attacks succeed after the initial login, not before it.
Q: How should teams implement just-in-time access for privileged operations?
A: Start with the highest-risk systems, define a strict approval and expiry window, and require automatic revocation at session end.
Practitioner guidance
- Standardise MFA for sensitive access paths Require multi-factor authentication on privileged, administrative, and sensitive application access, then verify that the policy applies consistently across cloud, hybrid, and on-premises systems.
- Prioritise passkeys for high-risk user populations Move administrators, developers, and other high-value users away from password-only login flows and toward passkeys or passwordless authentication where device binding is practical.
- Define where JIT access is mandatory Use just-in-time access for elevated permissions that should not remain permanently available, especially where the task is time-bound and the blast radius is large.
Bottom line: Legacy passwords and PINs still create avoidable exposure because reuse, phishing, weak secrets, and social engineering remain easy entry points.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:40 pm
Continuous control is becoming the real authentication boundary: The old assumption was that verifying a user once was enough to trust the rest of the session. That assumption no longer holds in cloud and hybrid environments where access paths, devices, and risk signals change after login. The implication is that identity programmes must treat authentication as an ongoing control point, not a single event.
A question worth separating out:
Q: How do organisations know whether continuous authentication is actually working?
A: Continuous authentication is working when active sessions can be challenged or revoked based on changing risk, not only at login. Useful signals include device drift, abnormal location changes, unusual session duration, and unexpected privilege use. If none of those signals are tied to enforcement, the organisation has monitoring, not continuous authentication.
👉 Read our full editorial: Authentication methods for 2026 are shifting toward continuous control