Month: July 2026

Our Blog

27 July 2026

Back to Blogs

Passwordless-by-Default: How to Implement Secure FIDO2 at Scale

Most security breaches start with a stolen password. Users often reuse the same simple strings across multiple sites, making them easy targets for hackers. Phishing attacks trick employees into handing over these credentials, bypassing even basic security measures. This cycle of password management causes frustration for users and a major headache for IT teams.

Passwordless-by-default is the answer to this security crisis. FIDO2 replaces weak, shared secrets with strong, public-key-based security that is nearly impossible to phish. When companies design their systems to use FIDO2 first, they stop relying on passwords. This approach is the only way to manage security at scale in a modern digital office.

This article explains how to build a passwordless security model. We will look at how FIDO2 works, why it makes business sense, and how to plan a large-scale rollout.

1. Understanding the FIDO2 Framework for Passwordless Authentication

FIDO2 is a set of standards that makes signing in secure and simple. It moves the responsibility of identity away from remembering secret strings and onto cryptographic keys. This change prevents attackers from stealing what they cannot see.

1.1 What is FIDO2 and How Does it Work?

FIDO2 brings together two standards: WebAuthn and CTAP. WebAuthn is the protocol that allows web browsers to talk to security keys or built-in hardware. CTAP manages the communication between your device and an authenticator like a security key.

Instead of sending a password to a server, your device creates a pair of keys. One is a private key that stays on your device, and the other is a public key that stays with the service provider. During sign-in, your device uses the private key to sign a request. The server verifies this signature with the public key. No shared secret ever travels over the network.

1.2 The Advantages of a Passwordless-by-Default Approach

Passwordless-by-default means you set up systems to prefer FIDO2 over everything else. This design stops attackers from falling back to insecure methods. It is the gold standard for blocking credential stuffing and phishing attacks entirely.

Users benefit from a faster experience. They no longer need to type long strings or wait for SMS codes. When a system is passwordless-by-default, IT teams also save money because they handle fewer helpdesk tickets for lost passwords. You secure your accounts and make work easier at the same time.

1.3 FIDO2 vs. Other Authentication Methods

Traditional multi-factor authentication, such as SMS codes or authenticator apps, still relies on a password as the first step. Hackers can intercept SMS codes or trick users into revealing them on fake login pages. Research shows that phishing remains highly effective against these legacy methods.

FIDO2 is different. Because the authentication is tied to a specific device and domain, a phishing site cannot trick a user into logging in. You effectively remove the human element from the security equation. When you compare the risk, passwordless methods are much stronger than even the best password-based setups.

2. The Business Case: Why Scale FIDO2 Now?

Moving to FIDO2 is an investment in security and efficiency. It is not just a technical change; it is a way to protect your firm’s reputation and bottom line.

2.1 Reducing Security Risks and Compliance Burdens

Credential theft is a common cause of data breaches. FIDO2 stops these attacks by design. Because there is no password to steal, brute-force attacks and man-in-the-middle attempts fail. This level of protection helps your firm meet strict compliance rules like GDPR or NIST standards. When you stop relying on passwords, you drastically lower your risk profile.

2.2 Enhancing User Experience and Productivity

Employees often struggle with password fatigue. They reset passwords frequently, which halts their work and frustrates them. FIDO2 allows users to log in with a simple touch, face scan, or security key. This creates a quick login process that lets staff focus on their actual work. Many companies find that this change increases job satisfaction by removing a major daily pain point.

2.3 The Cost Savings of Going Passwordless

The cost of a data breach can reach millions of pounds. By removing the primary entry point for hackers, you avoid these massive risks. You also save on operational costs. Each password reset costs IT teams time and money. By removing the need for password management, you free up those resources for other projects.

3. Planning Your FIDO2 Scale Implementation

A large move to FIDO2 requires a solid plan. You need to map out your current systems and decide how to roll out the new method without disrupting work.

3.1 Assessing Your Current Infrastructure and User Base

Start by taking stock of what you have. Which applications support FIDO2? Which identity systems do you use? You need to know if your users have compatible hardware, such as modern laptops or smartphones. Create a full list of your services and grade them by how critical they are to your daily operations. This helps you prioritise where to start.

3.2 Choosing the Right FIDO2 Authenticators

You have two main options for authenticators. The first is platform authenticators, such as Windows Hello, macOS Touch ID, or Android biometrics. These are built into the devices employees already use. The second is hardware security keys, like YubiKeys. These are small USB devices that offer high security for shared computers or high-risk roles. Most firms use a mix of both to ensure coverage.

3.3 Phased Rollout Strategy

Do not try to change everything at once. Start with a small pilot group, such as the IT team or a tech-savvy department. Gather feedback and fix any issues they encounter. Once the pilot is successful, roll out the change to other groups, perhaps by location or department. This gradual approach allows you to measure success and adjust your plan as needed.

4. Technical Implementation of Passwordless FIDO2

The technical setup is the core of your passwordless project. You must ensure your identity provider and your applications can talk to each other correctly.

4.1 Integrating with Your Identity Provider (IdP)

Your identity provider is the brain of your login system. Most modern identity platforms now support FIDO2. Check your provider’s documentation for how to enable WebAuthn. You will likely need to adjust your policies to make FIDO2 the preferred method. Ensure your setup allows for testing in a development environment before you push changes to production.

4.2 Developing or Adapting Applications for WebAuthn

If you build your own apps, your developers need to add WebAuthn support. The client-side code interacts with the device, while the server-side code verifies the public keys. This requires careful coding to ensure the keys are stored and checked securely. Prioritise this work for your most important internal tools first.

4.3 Managing and Revoking Authenticators at Scale

When a user loses their security key or gets a new phone, you need a way to manage that. Create clear processes for users to register new devices and revoke access for old ones. You should be able to audit these changes to see who has access to what. Managing this at scale requires good tools to track active keys and user status.

5. Overcoming Challenges and Ensuring User Adoption

The success of your rollout depends on how well your users accept the new system. People often resist change, so you must make the new way easy.

5.1 Addressing User Training and Support

Communication is vital. Explain why the move to FIDO2 matters and how it makes their work life better. Create short, simple guides that show how to set up their device. Host short training sessions or provide a dedicated help channel for any questions. If the process is confusing, adoption will be slow.

5.2 Handling Legacy Systems and Fallback Scenarios

Some old apps might not work with FIDO2 yet. You need a clear policy for these cases. Can you put a security wrapper around them, or must they stay behind a traditional login for now? Plan a clear timeline for moving these apps to a modern standard. Be honest about when these legacy methods will be turned off.

5.3 Security Best Practices and Ongoing Monitoring

Security is not a one-time project. Keep watching your logs for unusual patterns or failed login attempts. Stay updated on the latest news from the FIDO Alliance to ensure your setup remains current. As threats change, your security measures should also improve. Regular check-ins with your security team will help you stay ahead of potential issues.

Conclusion

Moving to a passwordless-by-default model is a major step forward for any firm. By using FIDO2, you remove the weakest link in your security chain while giving your users a smoother, faster way to work. You also reduce the costs and risks associated with password management. The path to a passwordless future is clear: assess your systems, plan your rollout, and focus on the human side of the change. Start your move to FIDO2 today to secure your firm for the future.

Our Blog

14 July 2026

Back to Blogs

ITDR + IAM Convergence: Detecting and Responding to Identity Attacks in Real Time

Passwords are no longer enough to keep your business safe. Attackers do not break into your network anymore; they simply log in. By stealing credentials or tricking employees, hackers gain access that looks legitimate. Traditional security tools often fail to spot these threats because they focus on the network edge rather than the user. To stay safe, you must combine Identity and Access Management (IAM) with Identity Threat Detection and Response (ITDR). This convergence creates a strong defence that sees identity attacks the moment they happen.

The Escalating Threat of Identity-Based Attacks

The way hackers operate has changed. Years ago, they targeted firewalls or weak servers. Now, they target people. Once an attacker has a valid username and password, they act as an authorised user. This makes it very hard for security teams to tell the difference between an employee and an intruder.

The Shifting Cyberattack Landscape

The shift from network perimeter breaches to identity compromise is clear. Attackers use automated tools to test stolen credentials against your systems. This is known as credential stuffing. If one user reuses a password from a different site, the attacker gets in. Phishing remains a top threat, too. A single deceptive email can steal a session cookie, letting an attacker bypass multi-factor authentication (MFA) entirely. Once inside, they look for ways to escalate privileges, moving from a standard user to an administrator.

The Impact of Compromised Identities

A data breach costs money and destroys trust. Recent reports show that breaches involving stolen credentials cost organisations millions in fines, lost business, and clean-up work. Take the SolarWinds attack as a famous example. Attackers used compromised identities to slip into the system and stay there for months. Business disruption is often severe. You might have to shut down entire systems to kick the attacker out. This leads to downtime, lost revenue, and damage to your brand. Regulatory penalties add another layer of pain, especially if you store customer data.

Understanding ITDR and IAM

To stop these attacks, you need two distinct but connected systems. IAM manages who has access, while ITDR watches for signs that someone is abusing that access.

What is Identity and Access Management (IAM)?

IAM is the gatekeeper of your organisation. It manages digital identities and controls what each user can do. Its main functions include authentication, which proves who you are, and authorisation, which decides what you can touch. IAM handles provisioning, which gives new employees access, and deprovisioning, which removes access when they leave. By enforcing the principle of least privilege, IAM ensures users only access what they need for their specific job. Without a solid IAM system, your access controls are messy and easy to exploit.

What is Identity Threat Detection and Response (ITDR)?

If IAM is the gatekeeper, ITDR is the security camera and guard. It focuses on identifying and responding to malicious activity linked to digital identities. ITDR uses behaviour analytics to spot anomalies. For example, if a user logs in from London and then from Tokyo ten minutes later, ITDR flags this impossible travel. It uses threat intelligence to see if an identity is acting in ways that match known attack patterns. ITDR can see insider threats that IAM might miss, like a user downloading massive amounts of data at 3:00 AM.

The Power of Convergence: ITDR + IAM

When you combine IAM and ITDR, you move from static security to active defence. They stop working as silos and start sharing data in real time.

Bridging the Gap Between Management and Detection

IAM provides the rules. ITDR watches how people follow those rules. In isolation, IAM just enforces policy. If an attacker bypasses the policy, IAM is blind to the threat. ITDR adds the detection layer. It spots when a user is breaking a rule or behaving strangely. When they work together, ITDR tells IAM to change access permissions immediately. ITDR can also show IAM where your policies are weak. If ITDR keeps flagging a specific service account, it might mean the IAM policy for that account is too loose.

Real-Time Threat Detection and Response Mechanisms

The power of this convergence shows up in automated workflows. When ITDR detects a threat, it can trigger an action in the IAM system. For instance, if ITDR spots a brute-force attack on a user account, it can automatically signal the IAM system to lock that account. It can also force an MFA re-prompt if the login attempt looks suspicious. This reduces the dwell time of an attacker. If you stop the threat in seconds, the attacker cannot move laterally or steal data. You can build playbooks that define these automatic responses to keep your team from manual work.

Enhanced Visibility and Context

Converged tools give you a unified view. Instead of jumping between an IAM dashboard and an ITDR console, you see the full picture in one place. You can correlate IAM events—like a role change with ITDR alerts like an unusual access request. This context is vital. It tells you why an alert is happening. You can see the history of the identity, the current risk score, and the recent actions taken by that user.

Implementing ITDR + IAM Convergence

Adding ITDR to your IAM strategy does not happen overnight. You need a plan to evaluate your current setup and pick the right tools.

Assessing Your Current IAM and ITDR Posture

Start with an audit. Look at your current IAM solutions and your security policies. Ask these questions:

  1. Do we have logs of all access attempts?
  2. How quickly can we disable a user account if we suspect a breach?
  3. Do we have visibility into privilege changes?

Once you audit your IAM, look for ITDR gaps. If you only have basic monitoring, you are missing out on identity-specific threat signals. Identify your most critical assets and the identities that control them. Focus your initial integration efforts on these high-risk areas.

Selecting the Right Integrated Solution

Look for tools that talk to each other through open APIs. You want a system where your IAM provider feeds data into your ITDR tool, and your ITDR tool can send commands back to your IAM system. Look for scalability. Your identity system will grow as your company grows. Ensure the vendor supports the platforms you use today, whether they are on-premise, in the cloud, or a mix of both. Ask vendors how they handle real-time alerts. A slow alert is as good as no alert.

Developing Effective Policies and Playbooks

You need a clear plan for what happens when an alert fires. Work with your security team to draft response playbooks. These should define:

  • What counts as a high-risk event (e.g., failed logins, suspicious access).
  • What the automatic response should be (e.g., lock account, notify admin).
  • When a human needs to step in and investigate.

Test these playbooks regularly. Update your policies as you see new types of identity attacks. If you change your network or move apps to the cloud, update your IAM and ITDR configs to match.

The Future of Identity Security

Security does not stand still, and neither should your tools. The future of this field relies on better data and faster automation.

Proactive Risk Mitigation Through Behavioral Analytics

We are moving toward systems that predict threats. By using AI and machine learning, ITDR tools can build a baseline of “normal” behaviour for every user. Any deviation from this baseline triggers an investigation. This means you do not have to write a rule for every possible attack. The system learns the patterns of your business. This turns security from a reactive measure into a proactive one, blocking bad actors before they cause damage.

Zero Trust Architectures and Identity Convergence

Identity is the core of Zero Trust. In a Zero Trust model, you never trust, always verify. You verify identity, context, and device health for every single access request. ITDR and IAM convergence are the engines that make this work. IAM enforces the “always verify” rule, and ITDR provides the “never trust” logic by continuously monitoring for suspicious activity. They form the foundation of a modern, secure organisation.

Conclusion

The convergence of ITDR and IAM is a necessary shift in how we defend against identity-based attacks. By unifying strong access controls with constant, real-time monitoring, you gain a massive advantage over attackers. You stop relying on perimeter defences that hackers bypass every day. Instead, you secure the identity itself.

Key Takeaways

  • Identity attacks are now the most common entry point for hackers.
  • IAM and ITDR are better together; IAM manages access, while ITDR detects abuse.
  • Automated responses, triggered by ITDR and executed by IAM, are critical to stop attackers fast.
  • A unified view of identity risk provides better context and faster decision-making.
  • Building an integrated identity security plan is essential for long-term safety in a digital environment.