1 Executive Summary

In this Leadership Compass, we assess solutions that lay the groundwork for enterprises in adopting passwordless authentication. To better understand the fundamental principles this report is based on, please refer to KuppingerCole’s Research Methodology.

Passwordless authentication has become a popular and catchy term. It is used to describe a set of identity verification solutions that remove the password from all aspects of the authentication flow and from the recovery process as well. To minimize the dependence on passwords, the industry has been working for a long time on different technical solutions and standards. As the industry continues to embrace innovative solutions, the era of passwordless is gradually evolving into more secure, user-friendly, and efficient authentication methods, marking a new stage in the evolution of digital security.

Given the security risks and inconvenience associated with passwords, there is a trend for organizations to replace and eliminate passwords altogether. Although the Internet has changed significantly since its inception, password authentication has remained virtually the same. The issue with passwords is that they can easily be stolen and compromised—without the knowledge of the user or the service provider. In addition, passwords can be costly, time-consuming, difficult to manage, and result in poor user experience. Furthermore, the fact that password reuse is a common practice among customers and employees only exacerbates the problem.

Figure 1: The problem with passwords

As a result, enterprises across various sectors are seeking more advanced security solutions to protect sensitive data and maintain high levels of operational integrity. In addition, as enterprises grow and their workforces become more mobile and distributed, particularly with the rise of remote work, the limitations of traditional passwords become even more pronounced. Large enterprises may have half a dozen or more different authentication systems, each potentially configured for different segments of the organization or for specific applications and services. This fragmentation may be due to historical acquisitions of other companies, departmental preferences, or the implementation of specialized solutions for certain types of data access.

Ensuring secure access across different devices and locations demands a more robust and flexible authentication method. Passwordless authentication systems have emerged as a compelling alternative, offering enhanced security features and improved user convenience compared to traditional methods. Adopting passwordless authentication can lead to significant cost savings for enterprises. It reduces the burden on IT support related to password issues and decreases the potential financial losses from data breaches linked to compromised passwords. By investing in passwordless technologies, enterprises not only strengthen their security measures, but also position themselves as forward-thinking, prioritizing both user experience and protection against future threats.

Although passwordless options have been around for a while, some recent solutions are gaining traction with enterprises and even consumer-facing businesses. For example, smart cards and hardware tokens have been used as an alternative to usernames and passwords for decades. Nevertheless, some of the distinctive features of passwordless solutions include the ability to support a wide range of authenticators, public key cryptography, biometrics, comprehensive APIs, frictionless user experience, and support for legacy applications and services.

It is important to note that passwordless authentication solutions tailored for enterprise use cases and those designed for consumer use cases exhibit distinct differences in response to varied expectations. Enterprise-focused solutions are typically designed to enhance security and control, integrating with existing corporate IT systems and aligning with internal security protocols and compliance requirements. These solutions often incorporate multifactor authentication (MFA) mechanisms that might include biometric data, security tokens, or mobile device verification to ensure robust protection against unauthorized access, particularly for sensitive corporate data and systems.

On the other hand, consumer-focused solutions must prioritize additional functionalities such as omnichannel experiences, self-service options, robust privacy management, a consistent and user-friendly interface, and the flexibility to operate on any device. These heightened expectations stem from the diverse preferences and demands of consumers who prioritize a personalized and adaptable authentication experience. The drive for convenience is paramount in consumer settings, where users expect to transition seamlessly between devices and platforms without noticeable security procedures hindering their interaction with digital services. For more information, read our Leadership Compass on Passwordless Authentication for Consumers.

Notably, user experience expectations diverge significantly between employees and consumers. Employees may tolerate more friction in the authentication process, aligning with organizational IAM policies, whereas consumers, driven by convenience, are prone to disengage if faced with complexity or delays. Additionally, consumer solutions must navigate the challenges of unmanaged IT environments, requiring adaptability to authenticate users securely on any device while prioritizing privacy and compliance with stringent regulations like GDPR. In essence, while both enterprise and consumer solutions aim for secure authentication, their emphasis on security measures, user experience, and scalability varies to meet the unique needs of each user category.

Figure 2: Main drivers of passwordless authentication adoption

However, organizations seeking passwordless authentication solutions must consider various factors, including security, ease of implementation, interoperability, and cost-effectiveness. The importance of user experience cannot be overstated, as seamless authentication processes are essential for further adoption. By understanding these considerations and evaluating the offerings from different vendors, enterprises can identify the solution that best meets their specific needs and preferences.

1.1 Key Findings

What are the top considerations buyers should know about?

• The passwordless authentication market is dynamic, vibrant, and competitive, with different vendors offering similar but distinct solutions.
• Despite the presence of major players, the evolving nature of the market allows smaller companies to enter and establish a niche by leveraging technical innovation or catering to specific use cases.
• User experience expectations diverge significantly between employees and consumers. While both groups benefit from the security and efficiency of passwordless systems, their divergent contexts and priorities necessitate tailored approaches.
• Enterprise-focused solutions are typically designed to enhance security and control, integrating with existing corporate IT systems and aligning with internal security protocols and compliance requirements.
• The creation of open standards such as FIDO2 and WebAuthn has increased the adoption of passwordless technologies. In addition, the use of passkeys is likely to be a catalyst for widespread adoption.
• The future promises a landscape where fewer passwords are needed, and their presence is largely obscured by passwordless solutions. However, passwords will still lurk in the shadows, along with the risks they impose, as lingering relics of an older era of digital authentication.
• The Overall Leaders (in alphabetical order) are 1Kosmos, Beyond Identity, Cisco, CyberArk, Entrust, HID, HYPR, IBM, Microsoft, Okta, OneSpan, Ping Identity, and Thales.