Converged credentials are identity credentials that allow users to securely access both physical facilities and digital systems through a unified identity framework. Rather than managing separate badges, tokens, passwords or authentication methods, organizations can govern access through a centralized credential strategy.

Most organizations still manage physical access and digital identity separately. Yet attackers increasingly exploit the gaps between buildings, devices, applications and identities. Converged credentials help close these gaps by bringing physical and logical access under a single identity framework.

According to the recent study The State of Physical and Digital Identity in the Enterprise by HID and the FIDO Alliance, 94% of organizations believe they can revoke all physical and digital access within 24 hours when an employee leaves. 

Yet 35% report experiencing delays or failures in doing exactly that over the past two years. More concerning still, 70% experienced at least one identity-related security incident overall.

At the Gartner Security & Risk Management Summit, Andrew Bull, Global Sales Director at HID, discussed why organizations struggle to maintain visibility across physical and digital identities and how converged credentials can help close those gaps.

The Hidden Risk of Credential Sprawl

Most organizations have established joiner-mover-leaver processes. New employees receive access quickly; role changes trigger updates, and departing employees are removed from core systems.

But what happens beneath the surface?

Throughout their tenure, employees often accumulate multiple forms of access:

  • Building access cards
  • Mobile credentials
  • Temporary visitor badges
  • Security keys and tokens
  • Application-specific credentials
  • Passkeys and authentication devices
  • Access privileges across specialized systems

The challenge is rarely granting access. The challenge is maintaining visibility over every credential issued throughout an employee’s life cycle.

As employees travel between offices, work on special projects, move into new roles or gain access to acquired systems, credentials can accumulate over time. Temporary access issued for a single day can remain active indefinitely. Additional badges, mobile credentials or subsystem permissions can be forgotten.

This creates credential sprawl, a growing security challenge in large enterprises.

Learn how converged credentials help reduce credential sprawl across physical and digital access environments.

Why Life Cycle Management Gets Harder at Scale

The front end of the identity life cycle is generally straightforward.

If employees cannot enter a building or access an application, they immediately raise the issue. Access problems are visible because users experience them directly.

The opposite is true when employees leave.

No one is there to identify forgotten credentials, outdated permissions or temporary access rights that were never retired.

The challenge grows even larger as organizations become more complex. The HID and FIDO Alliance study found that 59% of enterprises manage three or more credential and authentication systems, while 58% say identity management has become more complex during the past two years.

Each additional system creates another opportunity for access rights to fall outside centralized oversight.

Organizations frequently discover:

  • Temporary credentials that were never removed
  • Access rights granted during business travel
  • Permissions inherited through acquisitions
  • Legacy systems operating outside standard governance processes
  • Physical credentials that remain active after employment ends

These blind spots increase risk while creating additional challenges for compliance and audit teams.

Identity Governance Is Often Fragmented

One of the biggest barriers to effective identity management is fragmented ownership.

Facilities or security teams often manage physical access. Logical access falls under IT or cybersecurity. Department leaders may control business applications, while HR manages changes to employee status.

The research reveals the scale of this fragmentation:

  • Only 50% of organizations have unified reporting ownership for physical and digital identity
  • Just 48% have consolidated budget control across both areas

Without clear ownership, accountability becomes difficult. Teams may assume credential removal has occurred, while no one has visibility across the entire environment.

As organizations continue to expand and acquire new businesses, this challenge only becomes more pronounced.

A Single Credential, Multiple Environments

A common misconception about identity convergence is that organizations must replace existing infrastructure before they can move forward.

In reality, most enterprises have significant investments in physical access control systems, manufacturing technologies and specialized applications that cannot simply be replaced.

A converged credential strategy takes a different approach.

Instead of attempting to standardize every system, organizations can standardize user authentication across those systems.

With 59% of enterprises managing three or more distinct credential and authentication platforms, simplifying the identity layer can significantly reduce complexity.

The objective is straightforward:

One trusted credential framework that can support both physical and logical access.

Benefits include:

  • Reduced credential sprawl
  • Improved life cycle management
  • Better visibility into user access
  • Simplified governance
  • Stronger security controls
  • Improved user experience

Most importantly, organizations gain a single identity anchor that can be governed consistently throughout the employee life cycle.

Passkey Adoption: How to Close the Execution Gap

Technology alone does not improve security. Adoption does.

This is particularly true when implementing modern authentication approaches such as passkeys.

The HID and FIDO Alliance study found that 93% of organizations are already somewhere on their passkey adoption journey, and 65% report high or expert familiarity with the technology. 

However, only 13% have deployed passkeys at scale.

This deployment gap helps explain why organizations continue to experience identity-related incidents despite investing in stronger authentication technologies.

Many deployments struggle because users are expected to self-enroll and configure their own credentials. Support teams become overwhelmed, adoption slows and user frustration increases.

A more effective approach is to provision credentials before they reach users, creating a frictionless experience from day one.

When organizations remove complexity from the enrollment process, adoption improves dramatically.

Passkey Case Example: A Manufacturing Enterprise’s Challenge

One example highlighted during HID’s presentation at the Gartner Security and Risk Management Summit, London, involved a large manufacturing company operating across North and Latin America.

Years of acquisitions had created a fragmented environment consisting of:

  • Multiple physical access systems
  • Independent manufacturing platforms
  • Site-specific technologies
  • Separate credential management processes

Replacing every platform was unrealistic.

Instead, the organization focused on implementing a converged credential strategy that could support both physical and logical access while continuing to work with existing infrastructure.

The results were significant.

Employees no longer need to manage a collection of cards, keys and tokens across different facilities. Security teams gained greater confidence in credential life cycle management, while users benefited from a simpler and more consistent experience.

Passkeys: One Size Does Not Fit All

Another key lesson from successful convergence projects is that organizations should not force every user into the same authentication model.

Different roles have different requirements.

For example:

  • Office workers may prefer mobile credentials
  • Traveling employees may favor passkeys and smartphones
  • Manufacturing teams may rely on smart cards
  • Cleanroom personnel may work in environments where mobile devices are prohibited
  • High-security locations may require biometric authentication

The most successful identity programs support multiple authenticators while maintaining centralized credential governance.

This flexibility allows organizations to meet users where they are without sacrificing security or visibility.

Bringing Identity Back to a Single Control Point

Identity security has evolved far beyond authentication.

Today’s challenge is managing every credential issued throughout the employee life cycle across both physical and digital environments.

The latest research shows that organizations recognize the importance of this goal. Yet many continue to struggle with fragmented governance, growing complexity and inconsistent credential life cycle management.

A converged credential strategy offers a practical path forward.

By reducing credential sprawl, strengthening governance and establishing a single control point for identity, organizations can move beyond assumptions and toward verifiable security outcomes.

Because in identity security, access isn’t secure until it is verifiable. Organizations need evidence that every credential, physical and digital, is governed throughout its entire life cycle.

That’s what truly matters.

Key Takeaways

  • 94% of organizations believe they can revoke access within 24 hours, but 35% have experienced revocation failures or delays
  • 59% of enterprises manage three or more credential systems, increasing complexity and governance challenges
  • Only half of organizations have unified ownership across physical and digital identity programs
  • 93% are exploring or implementing passkeys, but only 13% have deployed them at scale
  • Converged credentials reduce credential sprawl while improving security, visibility and user experience
  • Successful identity programs focus on user adoption, flexibility and life cycle management rather than infrastructure replacement

Ready to simplify identity management across physical and digital environments? Explore HID’s passkey solutions, learn more about converged credentials, or speak with an HID identity expert.

Frequently Asked Questions

1. What is identity security?

Identity security is the practice of ensuring that only authorized individuals can access physical facilities, digital systems, applications and data at the appropriate time and level of privilege. It encompasses the technologies, policies and processes used to manage and protect digital identities across an organization, including authentication, authorization, credential management and access governance.

Modern identity security extends beyond usernames and passwords. It includes physical access credentials, mobile identities, smart cards, passkeys, biometrics and other forms of authentication that verify a user’s identity and control access to both physical and digital environments.

A strong identity security strategy helps organizations reduce the risk of unauthorized access, account compromise, insider threats and compliance violations while improving the user experience.

2. What are the most common types of identity theft?

In an enterprise context, identity theft occurs when an attacker gains unauthorized access to a user’s credentials or impersonates a trusted individual to access systems, applications, data, or facilities. Common forms include:

Credential Theft
Attackers steal usernames, passwords, passkeys, security tokens or authentication credentials through malware, data breaches or credential-stuffing attacks.

Phishing and Social Engineering
Cybercriminals trick employees into revealing credentials or approving fraudulent authentication requests by impersonating trusted organizations or colleagues.

Account Takeover (ATO)
An attacker gains control of a legitimate user account and uses it to access business systems, applications or sensitive data.

Privilege Abuse
Stolen or misused administrator credentials grant attackers elevated access, enabling them to move laterally across systems and expand their reach.

Physical Credential Misuse
Lost, stolen, or forgotten access cards, badges, keys and mobile credentials can allow unauthorized entry to facilities if not promptly revoked.

As organizations manage more identities, applications and credential types, protecting against identity theft requires strong authentication methods, including phishing-resistant passkeys, FIDO credentials and centralized identity governance.

3. What is the credential life cycle?

The credential life cycle refers to the complete journey of a credential from issuance to retirement. It includes all activities required to manage credentials securely throughout a user’s relationship with an organization.

The credential life cycle typically consists of:

  1. Issuance — A credential is created and assigned to a user, contractor, visitor or device
  2. Provisioning — The credential is configured with the appropriate access rights and permissions
  3. Use — The credential is used to authenticate and gain access to physical locations, applications, networks or services
  4. Modification — Access rights are updated as users change roles, locations or responsibilities
  5. Recovery and Replacement — Lost, stolen, expired or damaged credentials are replaced or reissued
  6. Revocation — Access rights are removed when they are no longer required
  7. Retirement — The credential is permanently deactivated and removed from all relevant systems

Effective credential life cycle management is essential for reducing credential sprawl, improving compliance, supporting audit requirements and ensuring that former employees, contractors and third parties no longer retain access after their relationship with the organization ends. A converged credential strategy can simplify this process by reducing the number of credentials to manage throughout the life cycle.