Why organizations are supporting more authentication technologies — and how to do it

By Ashish Jain, CTO, OneSpan

For almost a decade, the security industry’s conversations focused on what would replace traditional passwords. The assumption was that organizations would transition from legacy authentication to a single modern alternative. Now, we can see that isn’t the case. Instead, organizations have accumulated a patchwork of authentication technologies, leading to fragmentation.

This is happening for a few reasons. First, new technologies and regulations are rapidly emerging, requiring organizations to adopt solutions and tools. Second, fraudsters frequently change tactics, such as utilizing AI to create more realistic scams at a larger scale than before, requiring more sophisticated and adaptable defenses. When taken together, these factors make completely replacing existing investments prohibitively expensive.

As legacy authentication methods, such as traditional passwords, continue to serve critical use cases, modern technologies are introduced alongside them and the path to a transition becomes even more unclear.

One of the most recent authentication shifts we’ve seen is the widespread use of passkeys. Recent research from the FIDO Alliance found that 75% of consumers have enabled passkeys on at least some accounts, and 68% of organizations have deployed, piloted, or rolled out passkeys for employee authentication.

Other recent authentication trends include the rise of multi-factor authentication (with a 60% adoption rate in the financial services industry), biometrics (used daily by over 50% of consumers in the U.S.), and token-based authentication.

With every new authentication technology, there comes a new administrative console, policies, reporting tools, and workflows, fragmenting operations and requiring change management for end users. The result is a much more complex landscape than the one we once dreamed of.

To meet the moment, security leaders need a unified option to achieve consistent visibility, policy management, administration, and governance across every one of their authentication technologies, without needing to change customer behavior overnight or indiscriminately tear out infrastructure they’ve invested time and money in.

Modernizing authentication is a journey, not a single operational transition

One of the biggest mistakes I’ve seen organizations make is treating authentication modernization as a one-time, rip-and-replace technology upgrade. Not only can doing so cause user adoption issues, but it also sets organizations up for failure in the long run.

This is especially true for organizations in high-assurance, regulated industries, such as financial institutions. They support millions of customers, each with different preferences, devices, and authentication journeys. Because of this, they don’t have the luxury of starting from scratch. For example, a customer logging into a banking app from a modern smartphone has different authentication requirements than a customer calling the contact center to recover an account, making both authentication methods a requirement to support the needs of financial service customers.

Organizations that are working to modernize must be able to adopt whatever authentication method comes next without abandoning what already works. This ensures that operational abilities are on par with the technological advancements and accessibility that customers demand.

Here’s what I hope security leaders remember: There is no one-size-fits-all path to authentication modernization, and every organization is at a different stage of its journey. Some continue to rely heavily on hardware authentication because of regulatory or operational requirements. Others are expanding software authenticators, passkeys, digital credentials, and transaction security capabilities.

For the foreseeable future, most organizations will operate hybrid authentication environments while balancing security, user experience, regulatory requirements, and operational complexity.

4 steps to modernize authentication methods without disruption

The most effective approach to modernizing your authentication technologies is to introduce new methods alongside existing ones, helping them coexist. I recommend taking a practical path using the following four steps to avoid disrupting customers and employees.

First, start with high-impact use cases. Prioritize applications or user groups where phishing risk and login friction are highest. This will help your organization stay on top of evolving threats — particularly those that may cause the most damage — while still providing robust support to customers throughout their authentication journeys.

Next, introduce new authentication technologies alongside existing methods. Don’t remove current authentication approaches, but let them work in tandem. Remember, you’re asking the user to change a behavior they’ve been engaging in for a long time. It may require support and education to help them transition to more modern and secure authentication processes. Give them multiple authentication options, especially at the beginning, so they have time to get used to a new method.

Then, expand adoption across users and applications. Scale new authentication technology use based on user readiness, device support, and security risk profile. I recommend starting with mobile applications because most mobile users are already more accustomed to alternative authentication methods, such as Face ID, which they use to unlock their phone.

Finally, apply policy-driven authentication. Use contextual signals to determine when new authentication methods, like passkeys, are required for greater safety and security.

In our work with 60% of the world’s 100 largest banks, I’ve found that organizations that take a structured, flexible approach to modernizing their authentication methods can reduce risk, improve user experience, and future-proof authentication.

Looking to the future: From fragmented tools to a unified authentication platform

Over the next three to five years, I expect three major shifts to occur in digital identity.

First, passkeys will become the default. Across both consumer and workforce use cases, adoption will gain pace and passkeys will replace passwords. This change will reshape user behavior, account recovery, device enrollment, and how organizations establish trust throughout the customer journey. It does not mean other authentication methods will completely go away; instead, organizations will need the ability to support many authentication methods to meet the diverse user populations and use cases that they serve.

Digital credentials will also become a practical reality and reusable digital identity will move beyond pilots. Wallets, credential formats, trust frameworks, and verification ecosystems will mature, allowing people to prove they are who they say they are without repeatedly submitting documents or re-establishing their identity with every organization.

Finally, agent-based access will become a crucial consideration for security leaders. AI agents will increasingly interact with applications, data, and other agents on behalf of users and organizations. Passkeys, digital credentials, delegated authorization, and a new generation of agent-specific protocols will be needed to establish who authorized an agent, what an agent is allowed to do, and under what conditions an agent can act.

Fraud will continue to evolve in parallel to these changes. As passwords become less valuable and other authentication methods come to the forefront, attackers will focus more heavily on session hijacking, compromised devices, manipulated agents, fraudulent delegation, and social engineering. Consequently, authentication, identity verification, authorization, and fraud detection will need to work together as a unified and continuous trust system rather than a collection of disconnected controls.

To support these changes, organizations will need the ability to manage each technology from a single, unified security architecture. Investing in or building a platform or operating model that can enable continuous monitoring, management, and modernization without unnecessary disruption to existing systems, user experiences, or business operations is key.

Organizations that make this shift will future-proof their operations, helping them face the changing authentication landscape head-on and with minimal disruptions to both internal workflows and external customer experiences.

Modernize at your own pace — Begin where you are today

Modernizing authentication technologies doesn’t happen overnight, nor does it happen in a vacuum. It requires a concerted effort across teams and departments to support multiple authentication technologies simultaneously while balancing security, user experience, regulatory requirements, and operational complexity.

The sheer number of authentication technologies that exist may have made the landscape more complex, but security leaders can simplify it within their own organizations. The best place for decision-makers to start is taking time to evaluate where their organization’s authentication technologies stand, and then expanding over time and at their own pace. Adopting solutions that best support customer needs and investing in a platform or operating model that allows for simple, continuous modernization and management is a winning (and sustainable) approach.

Authentication has fundamentally changed. It’s time to change the way we approach it, too.

About the author

Ashish Jain is the Chief Product and Technology Officer at OneSpan, where he leads a global team spanning product, engineering, and operations. He is responsible for building a platform for authentication, mobile app protection, and fraud detection trusted by 60% of the world’s top banks.

Article Topics

authentication  |  biometrics  |  digital identity  |  identity security  |  OneSpan  |  passkeys  |  passwordless authentication