Should organisations prioritise device trust or user convenience in passwordless access?

Why device trust has to outrank convenience in passwordless access

Passwordless access removes the password as the primary secret, but it does not remove the need to trust the endpoint. If a device can register, store, or replay the authenticator, then the control is only as strong as that device’s assurance, posture, and recovery process. Convenience improves adoption, but it cannot be the deciding factor for control design.

The practical question is not whether passwordless should be easy to use. It should. The real decision is which assurance boundary carries the risk when sign-in is attempted from a new, lost, stolen, unmanaged, or compromised device. That boundary is usually the device, not the human, because the device often holds the credential, the key material, or the local approval path.

What changes when the authenticator becomes the centre of control

Once passwordless is deployed, the authenticator becomes the trust anchor for account recovery, step-up decisions, and session continuity. That changes the control model from “do we know the password?” to “do we trust this device, this enrollment, and this recovery path enough to issue access?” In practice, the weakest point is often not initial sign-in, but loss handling and reissue rules.

This is where device trust becomes a policy question as much as a technical one. Organisations need to decide whether a device is merely a convenience factor, or whether it is a managed assurance object with enrollment checks, attestation signals, revocation handling, and reproofing when the user changes devices. If those rules are vague, passwordless access becomes hard to govern at scale.

How to keep passwordless usable without turning it into a bypass

Convenience matters, but it should be engineered into the flow rather than granted by weakening assurance. Good passwordless design reduces friction for known-good devices, while raising the bar for first enrollment, device replacement, and recovery. That means the policy should be stricter where the blast radius is highest, especially for privileged users, remote access, and high-value applications.

Device trust also needs to be durable across the full lifecycle. If a user changes phone, replaces hardware, resets a security key, or calls the help desk for recovery, the organisation should know whether the old authenticator is still valid, whether a second factor is needed, and whether the new device inherits trust automatically or must earn it again. Passwordless and Passkeys Guide explains why passkey rollout succeeds only when recovery and enrollment are controlled, not just when sign-in is simplified.

Risk and Threat Considerations

Passwordless access can fail open when convenience shortcuts bypass device assurance, especially during enrollment, recovery, or help desk reset flows. The main exposure is not the absence of a password, it is the possibility that a weakly trusted device or a poorly verified reissue path becomes the easiest way back into the account.

Failure mechanism: Attackers target the weakest trust boundary, such as social engineering, device theft, unmanaged enrollment, or permissive recovery, then use the trusted authenticator path to obtain persistent access.

Impact: Account takeover becomes harder to notice and easier to retain, because the access looks like a legitimate passwordless sign-in rather than an obvious credential attack.

Practitioner Guidance

What to prioritise: Treat device trust, enrollment assurance, and recovery design as the first-order controls. If these are weak, user convenience is just a faster route to the wrong outcome.

What to verify: Confirm that a lost-device event, a replacement device, and a help desk reset each trigger explicit revalidation rules. The system should not silently inherit trust from the previous authenticator unless that is a deliberate, documented policy choice.

Decision rule: If the device can mint or release access, it must be governed more strictly than the user experience layer. Convenience can streamline the path, but it should never decide who is trusted.

Practitioner takeaway: Passwordless works best when convenience is the delivery mechanism and device trust is the control boundary; if those roles are reversed, the organisation gains usability at the expense of governability.

Related resources from NHI Mgmt Group

• How do organisations balance access convenience with stronger zero trust controls without creating user friction?
• When should organisations prioritise data classification and zero trust over broad cloud access convenience?
• When should organisations prioritise mobile access controls over device convenience?
• Should organisations prioritise passwordless or privileged access modernisation first?