Topic starter
12/02/2026 9:02 pm
TL;DR: WebAuthn reduces password reliance, with StrongDM reporting that many applications still use it as an added factor instead of a primary login method. Recovery, device trust, and enrolment now sit at the centre of IAM governance.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “What is WebAuthn? Web Authentication Explained”.
Key questions
Q: Why do passwordless programmes still need password reset capability?
A: Because most enterprises cannot remove every password at once.
Q: What are the biggest implementation mistakes with WebAuthn?
A: The most common mistake is treating WebAuthn as a cosmetic add-on while leaving passwords in place as the real trust anchor.
Q: How should security teams implement WebAuthn without creating browser support gaps for users?
A: Teams should treat WebAuthn as an authentication layer, not a universal replacement for every login flow.
Practitioner guidance
- Define a passwordless migration path Decide which user populations can move to WebAuthn as a primary login method and which must remain on staged rollout with fallback controls while applications still depend on passwords.
- Build enrolment and recovery workflows Document how users re-register devices, replace lost authenticators, and regain access without weakening identity proofing or turning exception handling into a back door.
- Separate authenticator trust from password risk Review whether the organisation is using WebAuthn as an additional factor or as the main authentication path, then align policy, application support, and help desk scripts accordingly.
Bottom line: WebAuthn reduces reliance on passwords, but it does not eliminate IAM governance; it moves the control point to authenticators, enrolment, and recovery.
Glossary terms: WebAuthn, Passwordless Authentication, Authenticator recovery, Relying Party
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 18 hours ago by NHI Mgmt Group
07/10/2026 9:47 pm
WebAuthn exposes an IAM adoption gap, not an authentication theory gap: The protocol itself is mature enough to support passwordless login, but many organisations still deploy it as a second factor layered onto password workflows. That means the access model remains anchored to the weakest legacy control instead of being redesigned around the new authenticator lifecycle. Practitioners should read this as a migration problem, not a feature rollout problem.
A question worth separating out:
Q: Should organisations prioritise device trust or user convenience in passwordless access?
A: They need both, but device trust must come first because the authenticator becomes the centre of the control model. Convenience matters for adoption, yet it should not override enrolment assurance, loss handling, and reissue rules that keep passwordless access governable at scale.
👉 Read our full editorial: WebAuthn shifts passwordless risk to enrolment and recovery
This post was modified 18 hours ago by NHI Mgmt Group