Going passwordless is difficult for a lot of companies, even the ones with “security” in the name. Jim Taylor, chief product and technology officer (and resident IT professional) at RSA Security, spoke with IT Brew about lessons learned as he led the deployment of passkeys, biometrics, and other non-password implementations across the organization. Two major keys to passwordless success, he said, include having lots of options and lots of patience. “There’s no big switch. I wish there was a big red button that you could just press and go, ‘Ta-da!’ with passwordless, right? It doesn’t work like that,” Taylor told IT Brew. The best security is optionality. RSA began its efforts just under a year ago, according to Taylor, starting with enabling passwordless login on the company laptops—a “gateway,” he said, to initiate more passwordless options across the company. If the company detects an elevated risk due to a factor like an unexpected login location, the system can trigger a secondary authentication method on the user’s phone, such as a push notification or QR code scan, according to Taylor. The out-of-band approach acts as extra security, given the unlikelihood that an attacker has access to both a laptop and a mobile device. Keep reading here.—BH | 
