Most identity and access (IAM) modernization programs do not fail at the start. They stall about two-thirds of the way through.
The first phase usually goes well. Cloud applications move behind single sign-on; MFA is switched for email and remote access, and passwordless authentication is piloted for a few teams. The dashboard looks healthy.
Then the program reaches the long tail: the thick-client finance system, the operational application on a segregated network, the line-of-business platform built fifteen years ago. These systems do not speak SAML, OIDC, or FIDO2. They expect a username and a password, and rewriting them is neither quick nor cheap.
This is where modernization quietly stops. Industry analysis in 2026 found that most enterprises that have deployed passwordless still cover less than half of their workforce, and a majority still rely on passwords somewhere in the stack. In government and critical infrastructure, that “somewhere” is often the system that matters most.
The question for CISOs and CIOs is no longer whether to go passwordless. It is how to remove the password from the parts of the estate that modern identity tools cannot reach, without a rip-and-replace programme nobody can afford to get wrong.
MFA and password vaults move the risk, but they do not remove it
Faced with legacy systems, most organizations reach for one of two workarounds. Both help. Neither removes the root cause.
- MFA on top of the password. A second factor makes a stolen password harder to use, but the password is still there. It can still be phished, replayed against a system that lacks MFA, or used for lateral movement once an attacker is inside. And exposed credentials are acted on quickly: Verizon’s 2026 Data Breach Investigations Report found that half of ransomware victims with a prior credential leak were hit within 95 days, and that weak-password findings take close to eight months to fix (Help Net Security).
- A password vault. Vaults take passwords out of users’ heads and put them in one place. That solves the weak-password problem by creating a concentration problem. Compromise the vault once, and every credential it holds is exposed.
This is the trade-off at the heart of legacy identity: you can have weak, user-managed passwords, or strong passwords stored in one high-value target. Unless the password is removed from both the user’s memory and central storage, the risk is only traded, never eliminated.
A useful test for any identity modernization investment: does it reduce the number of reusable credentials an attacker can steal, or does it just add a layer around them? Boards and regulators increasingly want evidence of the first.
A pragmatic model: coexist, remove the password, expand
The organizations making real progress treat identity modernization as an incremental program, not a migration event. Three principles separate them from the ones that stall.
Each step reduces risk on its own; the shared metric keeps the program honest.
1. Coexist with the identity stack you already own. Active Directory, ADFS, Entra ID and Keycloak represent years of investment, policy, and integration. A modernization approach that requires replacing them creates more delivery risk than it removes. The authentication layer should sit alongside the directory, not compete with it.
2. Remove the password at the source, including legacy apps. The breakthrough is separating what the application needs from what the user handles. A legacy application can keep receiving a strong, policy-compliant password while the user never sees, types, or reuses it. With modern cryptography such as Oblivious Pseudorandom Functions (OPRF) and Secure Multi-Party Computation (MPC), that credential can be derived on demand after the user approves on a trusted device, and never stored anywhere, so there is no vault to breach. Binding derivation to a registered corporate device makes it phishing-resistant: a user tricked into approving from the wrong place cannot complete the login.
3. Expand system by system, measured on credential exposure. Start with the applications that carry the most risk or generate the most password resets. Track progress by how many reusable credentials have been removed, not by how many users have MFA enabled. That is the metric a board and a regulator can act on.
This model turns modernization from a single high-stakes cut-over into a series of low-risk steps, each of which reduces risk on its own.
See how this works in practice on our Identity & Access Modernization page.
Sovereignty: the constraint cloud-first identity can’t solve
For government, defense and critical infrastructure, there is a second reason modernization stalls: where authentication runs, and who ultimately controls it.
Many passwordless services are delivered from the cloud by US-headquartered providers. Under the US CLOUD Act, US-incorporated providers can be compelled to produce data they control, regardless of where it is hosted. For a ministry, a national energy operator or a central bank, placing authentication data and cryptographic trust under a foreign legal jurisdiction can be a non-starter, whatever the hosting region.
Three questions help security leaders test whether an identity modernization approach fits a sovereign environment:
- Where does every component run? On customer-provisioned, on-premises or private-cloud infrastructure, or in a vendor’s cloud?
- Can it be deployed without internet access? Segregated and high-security networks need an installation that works with no outbound connectivity, plus a login path for workstations that have no network at all.
- Who is the vendor accountable to? The legal jurisdiction of the provider matters as much as the location of the servers.
The market is moving quickly. The global passwordless authentication market is estimated at US$27.03 billion in 2026 and forecast to reach US$100.62 billion by 2034, a 17.86% CAGR (Straits Research). North America accounted for 36.8% of 2025 revenue; the Middle East and Europe are now catching up, and sovereignty will shape which solutions they adopt.
An IAM modernization checklist for CISOs and CIOs restarting a stalled program
- Map the long tail. List every application that still needs a password, and rank by business criticality and password-reset volume.
- Change the success metric. Report reusable credentials removed and attack paths closed, not MFA enrolment rates.
- Rule out rip-and-replace early. Require any new authentication layer to coexist with your current directory and identity providers.
- Ask where the secret lives. If a solution stores, synchronizes, or vaults the password, you have moved the target, not removed it.
- Insist on phishing resistance. Prefer approaches that bind authentication to a registered corporate device.
- Test sovereignty, not just hosting. Check the deployment model, air-gap capability, and the vendor’s legal jurisdiction.
- Build in auditability. Every login, failure and admin action should flow to your SIEM or SOC as evidence for regulators.
- Pilot where it hurts most. Start with one high-risk legacy system and one user group, prove the outcome, then expand.
Modernize the estate you actually have
Identity and access modernization succeeds when it meets the estate as it is: hybrid, heterogeneous and full of systems that will be around for years. The goal is not to replace everything. It is to remove the password, the root cause of credential risk, everywhere it still lives, including the legacy applications that cloud-first tools leave behind.
QuantumGate Salina was built for exactly this. It brings phishing-resistant, passwordless authentication to Windows logon, single sign-on and legacy password-based applications, coexists with Active Directory, ADFS, Entra ID and Keycloak, and derives credentials on demand so there is no vault to breach. Every component runs on your own infrastructure, delivered by a UAE-incorporated company with sovereign cryptography.
Explore Identity & Access Modernization with Salina or book a 30-minute technical demo to see passwordless access to legacy applications in action.
Frequently asked questions
What is identity and access modernization?
Identity and access modernization is the move from password-dependent, fragmented authentication to phishing-resistant, centrally governed access aligned with Zero Trust. It covers directories, single sign-on, MFA, and passwordless authentication across both modern and legacy applications.
Can legacy applications use passwordless authentication?
Yes. Applications that only accept a password can keep receiving one, while the user never sees or types it. The credential is generated and supplied after the user approves on a trusted device, so no application code changes are needed.
Is a password vault the same as passwordless?
No. A vault stores passwords centrally, which removes them from users’ memory but creates a single high-value target. True passwordless approaches remove the stored secret altogether, for example by deriving credentials on demand.
Do I need to replace Active Directory or Entra ID to go passwordless?
No. Passwordless authentication can coexist with Active Directory, ADFS, Entra ID and Keycloak, letting organizations adopt it incrementally without a rip-and-replace migration.
What makes authentication phishing-resistant?
Authentication is phishing-resistant when a stolen or tricked approval cannot be replayed from an attacker’s device. Binding authentication to a registered corporate device is one of the strongest ways to achieve this.
Can passwordless authentication run on-premises or in air-gapped environments?
Some solutions can. On-premises platforms that install without outbound internet access, and support offline login for disconnected workstations, suit government, and critical infrastructure networks.
Sources
- Verizon 2026 DBIR findings, Help Net Security
- Passwordless Authentication Market, Straits Research
- Salina Technology Overview (Sept 2026), Salina HLD v1.0, Salina Competitive Matrix (Sept 2026), internal