Topic starter
11/07/2026 8:27 pm
TL;DR: Credential management is being framed as a resilience dependency, not an isolated IAM function, according to Versasec. Passwordless and zero-trust programmes still need clear ownership and disciplined lifecycle control if access is to stay reliable at enterprise scale.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Why Security is the Non-Negotiable Infrastructure Foundation | An Interview with Board Member Fredrik Runnquist”.
Key questions
Q: Why does weak credential management create business continuity risk?
A: Because access failure can stop operations, not just lock out a user.
Q: Where does credential governance fail in practice?
A: It fails when teams treat the vault as the control and ignore lifecycle events around sharing, role change, metadata exposure, and offboarding.
Q: How should IAM teams govern credential management for zero-trust and passwordless programmes?
A: They should govern credentials as lifecycle assets, not as isolated login artefacts.
Practitioner guidance
- Align credential governance to resilience objectives Define credential issuance, rotation, and retirement as part of business continuity planning, not just IAM operations.
- Inventory all credential-bearing identity types Create one governed view of smart cards, virtual smart cards, certificates, and software-based credentials so lifecycle ownership is not split across separate tools or teams.
- Review passwordless readiness through lifecycle control Check whether passwordless designs have deterministic issuance, revocation, and fallback handling for every credential type they depend on.
Bottom line: Credential management is being framed as a resilience dependency, not an isolated IAM function.
Glossary terms: Zero Trust, Credential Lifecycle Governance, Passwordless Authentication, Authenticator Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 8:57 pm
Credential management has become an infrastructure control, not a support function. The interview is explicit that strong identity and credential management now sits inside the business continuity conversation, not alongside it. That shift matters because credential governance is no longer judged only by audit readiness; it is judged by whether it can preserve access assurance under operational stress. IAM leaders should therefore treat credential lifecycle control as a resilience dependency.
A question worth separating out:
Q: What should organisations do if passwordless adoption is outpacing credential controls?
A: Pause broad rollout until issuance, revocation, and fallback processes are reliable for every credential type in scope. Expanding passwordless on top of weak lifecycle governance just moves the risk from passwords to unmanaged authenticators and makes incidents harder to contain.
👉 Read our full editorial: Security foundations for credential management and zero trust