Topic starter
11/07/2026 8:27 pm
TL;DR: Credential management is framed here as the foundation for passwordless and zero-trust architectures, with the interview arguing that weak identity and credential controls can become a business continuity risk rather than a technical inconvenience, according to Versasec. The practical message is that IAM teams should treat credential lifecycle governance as infrastructure resilience, not as an optional control layer.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Why Security is the Non-Negotiable Infrastructure Foundation | An Interview with Board Member Fredrik Runnquist”.
Key questions
Q: How should IAM teams govern credential management for zero-trust and passwordless programmes?
A: They should govern credentials as lifecycle assets, not as isolated login artefacts.
Q: Why does weak credential management create business continuity risk?
A: Because access failure can stop operations, not just lock out a user.
Q: Where does credential governance fail in practice?
A: It fails when teams treat the vault as the control and ignore lifecycle events around sharing, role change, metadata exposure, and offboarding.
Practitioner guidance
- Align credential governance to resilience objectives Define credential issuance, rotation, and retirement as part of business continuity planning, not just IAM operations.
- Inventory all credential-bearing identity types Create one governed view of smart cards, virtual smart cards, certificates, and software-based credentials so lifecycle ownership is not split across separate tools or teams.
- Review passwordless readiness through lifecycle control Check whether passwordless designs have deterministic issuance, revocation, and fallback handling for every credential type they depend on.
Bottom line: Credential management is being framed as a resilience dependency, not an isolated IAM function.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:57 pm
Credential management has become an infrastructure control, not a support function. The interview is explicit that strong identity and credential management now sits inside the business continuity conversation, not alongside it. That shift matters because credential governance is no longer judged only by audit readiness; it is judged by whether it can preserve access assurance under operational stress. IAM leaders should therefore treat credential lifecycle control as a resilience dependency.
A question worth separating out:
Q: What should organisations do if passwordless adoption is outpacing credential controls?
A: Pause broad rollout until issuance, revocation, and fallback processes are reliable for every credential type in scope. Expanding passwordless on top of weak lifecycle governance just moves the risk from passwords to unmanaged authenticators and makes incidents harder to contain.
👉 Read our full editorial: Security foundations for credential management and zero trust