Episode 116 -- Passwordless at Enterprise Scale: Bridging Technology and Organizational Readiness
In Episode 116 of the Cybersecurity Readiness Podcast Series, Dr. Dave Chatterjee is joined by two leaders at the front line of the effort to retire the password: Jim Taylor, President and Chief Product and Strategy Officer at RSA, and Andrew Shikiar, Chief Executive Officer and Executive Director of the FIDO Alliance. The pairing is distinctive: a solutions provider that rolled out passwordless authentication across its own workforce, and the open, cross-industry standards body whose specifications make such rollouts possible. Dr. Chatterjee cites research reports showing that RSA’s deployment reached roughly 1,000 employees, eliminated about 260,000 password-based logins, and cut password-related help desk costs by 90 percent. Taylor explains that RSA, whose customers include governments and banks, set out to prove the approach on itself: as Taylor puts it, “If we can do it, anybody can do it.”
Taylor reports that RSA is now at roughly 98 percent passwordless, with the remainder tied to legacy systems and unusual use cases, and that the hardest part was not the technology but the people. Registration experiences that users abandoned, behavior that differed from what engineers expected, and the need for flexible authenticators all demanded attention. RSA responded with an enable, default, and require sequence, starting with its own CISO and CIO as the first users. Shikiar describes how FIDO’s open standards, certification programs, usability testing, and deployment guidance support this work, and shares that more than 7 billion passkeys are now in use. Dr. Chatterjee defines the key terms for listeners: every passkey is passwordless, but not every passwordless method is a passkey.
The episode’s central lesson is that passwordless success depends on bridging technology and organizational readiness: the cryptography is well understood, but adoption succeeds or fails on people, process, and preparation. Viewed through Dr. Chatterjee’s Commitment–Preparedness–Discipline (CPD) Framework, passwordless adoption is a leadership and change-management challenge as much as a technology one: executives commit by going first, the organization prepares through education, communication, and flexibility, and discipline institutionalizes use until it is no longer a choice. Both guests affirm that passwordless is real and that organizations should start now. Shikiar adds a pragmatic caveat: the near-term goal is “less passwords, not passwordless,” beginning with the most targeted users, making any remaining password use anomalous, and securing account recovery, since a password fallback can still be exploited.
To access and download the entire podcast summary with discussion highlights - https://www.dchatte.com/episode-116-passwordless-at-enterprise-scale-bridging-technology-and-organizational-readiness/
Connect with Host Dr. Dave Chatterjee
LinkedIn: https://www.linkedin.com/in/dchatte/
Website: https://dchatte.com/
Books Published
Cybersecurity Readiness: A Holistic and High-Performance Approach
Articles & Cases Published
Chatterjee, D. (2026). The Cryptographic Reckoning: Why Quantum Readiness Begins with Agility, Not Algorithms, The INFORMS Analytics Magazine, June 26, 2026
Chatterjee, D. (2026). The New Digital Fragility: How AI-Enhanced Cyber Threats Are Reshaping Operational Resilience, The INFORMS Analytics Magazine, March 4, 2026
Chatterjee, D. (2026). Root: Automating the Remediation Gap, Ivey Publishing, Jan 7, 2026.
Chatterjee, D. and Leslie, A. (2024). “Ignorance is not bliss: A human-centered whole-of-enterprise approach to cybersecurity preparedness,” Business Horizons, Accepted on Oct 29, 2024.
Chatterjee, D. (2023). “Mission critical – How American Cancer Society successfully and securely migrated to the cloud amid the pandemic,” I by IMD, March 13, 2023.
Chatterjee, D. (2022). “Preventing security breaches must start at the top,” I by IMD, September 28, 2022, Institute for Management Development, Lausanne, Switzerland
Benz, M. and Chatterjee, D. (2020). “Calculated Risk? A Cybersecurity Evaluation Tool for SMEs,” Business Horizons, available online from May 4, 2020
Chatterjee, D. (2019). “Should Executives Go To Jail Over Cyber Attacks,” Journal of Organizational Computing and Electronic Commerce, Vol 29, Issue 1, pp. 1-3.
Abraham, C., Chatterjee, D., and Sims, R. (2019). “Muddling through cybersecurity: Insights from the U.S. healthcare industry,” Business Horizons, July 2019.
