At the RSA Conference 2025, Andy Ozment, Chief Technology Risk Officer at Capital One, took the stage with a candid and practical exploration of a topic that has long hovered at the intersection of aspiration and implementation: going passwordless. In his session, titled “Dude, Where’s My Password? The Challenges of Getting to Passwordless,” Ozment laid out the realities, trade-offs, and breakthroughs of Capital One’s ongoing transition to a password-free future.
The password problem
The premise is simple but critical: passwords are outdated. For decades, they’ve served as the default gatekeepers to digital systems, yet they remain a top vulnerability. Breaches, phishing, and credential stuffing continue to expose this flaw. Capital One, like many major institutions, recognized that even strong passwords paired with weak human behavior make for a security liability.
Moving away from passwords isn’t just about tightening security—it’s about building trust and convenience into the user experience.
A journey, not a switch
Capital One’s transformation didn’t happen overnight. It began with early groundwork:
Single Sign-On (SSO) in 2005, to simplify access across applications.
Multi-Factor Authentication (MFA) in 2015, initially using email, voice, and SMS—methods that were eventually deemed too vulnerable.
By 2019, MFA evolved to app-based one-time passcodes and push notifications.
In 2023, the major pivot came with FIDO2 security keys and biometrics.
Each phase built upon the last, showing that passwordless is less a product and more a strategy—a design philosophy woven into systems, policies, and culture.
Building the architecture for passwordless
Behind the scenes, several strategic moves enabled the shift:
Cloud migration: With its data centers closed by 2020, Capital One leaned fully into the cloud, gaining the flexibility needed to support modern authentication systems.
Modern authentication standards: OAuth, mTLS, and SAML helped unify identity access across a wide range of services.
Corporate device control: Authentication occurs on secure, managed devices—whether through native environments or virtual desktops.
By 2025, 89% of internal and 65% of external applications supported passwordless login. That figure continues to grow.
Hurdles on the road
Naturally, this transformation came with challenges:
Identity proofing: Registering users with strong assurance required new methods—smartphone scans of government IDs, video verification, and token-based checks.
User friction: Changing user habits always meets resistance. Support, education, and thoughtful onboarding were key.
Hardware constraints: Not everyone has a compatible device, so fallback options and kiosks are being explored, particularly for secure or restricted environments.
Looking ahead
Ozment’s message was clear: passwordless is not just a technical upgrade; it’s a cultural shift. It requires orchestration across IT, security, compliance, and user experience teams. But once implemented, the benefits—greater security, less friction, and increased trust—pay off exponentially.
Capital One’s journey is instructive, not because it’s finished, but because it is deliberate, iterative, and transparent. For those navigating similar transformations, the real question is no longer if we should go passwordless—but how soon we can get there.
