“Authentication Is Dead”: CrowdStrike Executive Proposes User Recognition

Repeatedly checking passwords and authentication codes cannot fully solve phishing attacks or the inconvenience of logging in. Instead of requiring users to prove their identity every time, we need to move toward systems that recognize users they already know.” Ian Glazer, Head of Continuous Identity Product Strategy at CrowdStrike, made the remarks during a keynote address on the second day of Authenticate U.S. 2026, held in Carlsbad, California, on October 20 (local time).

In his presentation, titled “Authentication Is Dead: Recognition as the Digital Front Door,” Glazer challenged the limitations of traditional login methods and proposed a new direction for digital authentication. Ian Glazer, Head of Continuous Identity Product Strategy at CrowdStrike / Courtesy of the FIDO Alliance. CrowdStrike is a U.S. cybersecurity company specializing in enterprise endpoint security, cyber threat detection and response, and identity-based attack protection.

Glazer previously led identity and privacy research at Gartner and worked on identity product strategy at Salesforce. He also helped establish IDPro, a professional organization for digital identity specialists. “Today's attackers are no longer necessarily breaking into systems.

Instead, they are using stolen credentials to enter through legitimate login processes,” Glazer said. He highlighted account recovery as a particularly problematic area. For services that people rarely use, forgotten passwords frequently turn account recovery into a routine alternative to logging in, creating additional opportunities for attackers.

Glazer proposed “recognition” as an alternative. Rather than requiring users to prove their identity at every login, systems could continuously determine whether someone is a familiar, legitimate user by evaluating device information, behavioral characteristics and other signals. During the keynote, Glazer invited an attendee he had just met onto the stage to demonstrate how people can make trust judgments without formally checking someone's identity documents.

Humans recognize familiar faces and draw on previous interactions, he explained, while computers repeatedly demand proof of identity even from users they have already encountered. “Today's behavioral security technologies are primarily used to detect when someone is not the usual user,” Glazer said. “We should develop technologies that can recognize when someone is the usual user.” He suggested that information available from operating systems, browsers and endpoint security platforms could make such a shift possible.

If systems could continuously recognize legitimate users, repeated login procedures could be reduced. Additional authentication would be required only when the system detected that the person accessing a service might have changed. Unlike conventional approaches that maintain a login session for a fixed period, this model would continuously evaluate the level of trust associated with the user in real time.

Ian Glazer delivers a keynote address at Authenticate U.S. 2026 in Carlsbad, California, on October 20, referencing Bob Blakley's “The Death of Authentication.” / Courtesy of the FIDO Alliance. The role of passkeys, which the FIDO Alliance has been promoting as a passwordless authentication method, would also change under this model.

In normal circumstances, the system would recognize the user automatically. When recognition failed, a passkey could be used to verify the user's identity again, allowing the system to reestablish trust and continue recognizing legitimate activity. “The work we have put into expanding passkey adoption will not be wasted,” Glazer said.

“Passkeys will become a powerful tool for helping systems recognize users again.” However, privacy protection and technical reliability remain major challenges. Continuous recognition requires information about users' devices and behavior. Glazer described this approach as a form of “participatory surveillance.” He emphasized that users must voluntarily consent to such monitoring and that, wherever possible, information should be processed locally on their devices, with raw data discarded afterward.

Current technology also has limitations that prevent recognition from reliably replacing conventional logins. If users interact with a service only briefly, the system may not have enough behavioral information to establish their identity with sufficient confidence. Glazer acknowledged that recognition technology has not yet reached the level of reliability required to consistently replace traditional authentication.

His presentation was therefore a proposal for the future direction of authentication technology rather than a demonstration of a fully commercialized replacement for login systems. Authenticate U.S. 2026 brought together speakers from major global technology companies including Google, Microsoft, Amazon, Meta and OpenAI; financial and payment institutions such as Visa, Mastercard and JPMorgan Chase; and cybersecurity companies including CrowdStrike, Palo Alto Networks and Okta.

Approximately 1,000 specialists involved in developing and deploying authentication technologies gathered to discuss current challenges and future directions. Against this backdrop, Glazer's keynote challenged the industry's longstanding assumption that users must repeatedly authenticate themselves to access digital services. “The next challenge is making recognition reliable enough that it can serve as the starting point for a new session,” Glazer said.

“Traditional authentication should become the emergency exit we use when necessary, rather than the front door we pass through every day.” Authenticate is a digital identity and authentication conference organized by the FIDO Alliance, an international organization that develops online authentication standards.