RSA Wants to Kill the Password - Without Killing the Systems That Still Depend on It

For a certain generation of office worker, cybersecurity had a sound: the plastic click of an RSA SecurID fob against a badge. Its tiny screen produced a new six-digit code every 30 or 60 seconds. You typed the code after your password, waited, and entered the corporate network. It felt faintly military, mildly annoying and reassuringly physical.

RSA Security now wants that password gone. The Burlington, Massachusetts company sells a unified identity platform built around authentication, access, governance and the full lifecycle of a digital identity. The new objects are passkeys, biometrics, mobile prompts, QR codes and FIDO security keys. The new risks include synthetic voices calling the help desk, compromised phones, orphaned employee accounts and AI agents asking for privileged data.

The clever bit is not that RSA discovered passwordless login. It did not. Microsoft, Okta, CyberArk, Ping Identity, Cisco and a crowded shelf of specialists are pursuing the same destination. RSA's bet is more specific: the winner in high-assurance identity will be the vendor that gets modern authentication into the least modern places without switching off the business.

A cryptography name, an identity business

RSA begins with three MIT academics and one wonderfully economical brand name. Ron Rivest, Adi Shamir and Leonard Adleman developed their public-key cryptosystem in 1977 and founded RSA Data Security in 1982 to commercialize it. The algorithm became part of the scaffolding of secure digital communication. The founders later shared the ACM Turing Award. RSA released the algorithm into the public domain in 2000 and does not own, sell or manage it today.

The modern company is not a cryptography laboratory. It is an enterprise software vendor whose flagship, RSA ID Plus, combines multifactor and passwordless authentication, single sign-on, contextual access, directories, self-service and hybrid continuity. RSA Governance & Lifecycle handles the bureaucratic half of identity: who received access, who approved it, whether it remains appropriate, and what happens when someone changes jobs or leaves.

Then come the sharp-edge products. Risk AI evaluates behavior and context before allowing access. Mobile Lock looks for dangerous conditions on a phone. Help Desk Live Verify confirms both the support agent and the caller without asking either person to trade a reusable secret. Authentication Manager keeps on-premises infrastructure in the picture. Hardware keys remain available for people who need a physical root of trust.

The breach that priced trust at $66.3 million

Any serious account of RSA has to pass through March 2011. Attackers used a spear-phishing email and malware to reach information related to SecurID. The theft was later connected to an attempted intrusion at defense contractor Lockheed Martin. RSA offered replacements or monitoring to customers, while parent EMC recorded a $66.3 million remediation charge.

What failed first was not the mathematics or the token display. It was a human and an email attachment, followed by an architecture that allowed the intruders to move toward highly sensitive material. The episode is an enduring rebuttal to the idea that a strong authentication device can compensate for every other weakness around it.

“The motivation to go passwordless was twofold: to reduce credential risk and strengthen RSA's security posture, and to stop speaking about passwordless deployment from a distance.”FIDO Alliance case study on RSA's internal deployment

The breach did not immediately turn RSA into today's platform. Corporate ownership changed around it. EMC had bought RSA for $2.1 billion in 2006. Dell inherited the business through its EMC acquisition, then sold RSA in 2020 to a consortium led by Symphony Technology Group for an announced $2.075 billion. The portfolio was subsequently split into focused companies: identity stayed with RSA; fraud prevention became Outseer; Archer and NetWitness went their own ways; the conference became independent.

That surgery clarified the pitch. RSA no longer had to be a department store of security products. It could concentrate on identity, while the market itself supplied the urgency. Cloud migration multiplied login surfaces. Remote work dissolved the office perimeter. Attackers learned to fatigue MFA users and manipulate support staff. Compliance teams demanded proof of who had access, not merely confidence that a login looked valid.

Who buys the ugly edge cases

RSA says more than 9,000 organizations use its products to manage over 60 million identities. Its favored customers are government agencies, banks, insurers, hospitals, energy providers and critical infrastructure operators. They have old applications, strict audit requirements, expensive downtime and users who cannot all be forced onto the same shiny device.

An anonymized APAC bank case describes 20,000 internal users, including more than 5,000 privileged users, plus 30,000 high-net-worth business-banking customers moving into an ID Plus cloud environment. A state agency case centers on tens of thousands of employees and millions of constituents. Sorenson Communications used Governance & Lifecycle while moving a complex estate to the cloud. These are migrations with committees, exceptions and consequences.

RSA therefore competes by embracing deployment variety: public and private cloud, on-premises, hybrid, offline and, with its 2026 Sovereign Deployment, air-gapped configurations. Microsoft is both rival and important partner. RSA integrates with Entra ID, External Authentication Methods, Edge for Business, Security Copilot and Microsoft 365 E7. The proposition is that Microsoft protects its ecosystem well, while RSA extends controls across Microsoft, non-Microsoft and legacy resources.

The business model is familiar enterprise SaaS with hardware and services attached. RSA publishes ID Plus plans from $3 per user per month for cloud-only IAM, through $5 hybrid authentication, $6 Entra enhancement and $7 hybrid IAM. Premium features and sovereign deployments require a quote. Professional services and channel partners help with integration. The meter is a user; the economic argument is the breach, outage or failed audit that does not happen.

What changed RSA's mind

The token company did not suddenly decide tokens were silly. It widened the unit of security. A rotating code proves possession of a seed-linked device at one moment. Modern identity systems must also judge the device, behavior, location, requested resource, enrollment process and recovery path. The help desk matters because an attacker who persuades an agent to reset a credential can stroll around the strongest front door.

RSA tested the argument on itself. Beginning with a 2024 goal, it rolled passwordless authentication across its global workforce using ID Plus. The documented playbook is pleasingly unmagical: secure executive backing, define the architecture, pilot with real users, offer multiple authenticators, communicate repeatedly, enforce in phases and maintain the system after launch. People received low-stakes opportunities to practice before the old behavior disappeared.

That is the part readers can copy. Do not buy a passkey project and call it transformation. Inventory the population and applications. Decide how a contractor, phone-less worker and locked-out executive will authenticate. Build recovery before launch. Give users more than one safe method. Pilot on people with different jobs and devices. Make the secure route easy, then make it mandatory. Measure support tickets and abandoned enrollment, not just successful logins.

When the RSA approach is too much

RSA's strengths are also buying filters. A 70-person cloud startup using one productivity suite, modern laptops and few regulatory constraints may not need hybrid failover, hardware tokens, identity governance dashboards or an air-gapped option. A simpler platform can be cheaper to operate and easier to understand. Complexity bought in anticipation of complexity still has to be staffed.

The approach can also fail when identity is treated as a security-team installation instead of an operating change. Weak executive sponsorship, one mandatory authenticator, poor device coverage, no recovery design or a help desk trained after launch will produce workarounds. Passwordless does not remove credentials so much as redistribute trust among devices, biometrics, enrollment and recovery. Each new dependency needs an owner.

In January 2026, RSA Group closed a $135 million lender-backed capital infusion and refinanced its debt. The money is earmarked in part for AI-assisted product development. By March, RSA had announced deeper Microsoft 365 E7 support and Sovereign Deployment. In June, it added Linux passwordless support and broadened Live Verify to people without registered authenticators, using government ID checks powered by ID Dataweb.

The company now occupies an interesting corner of the identity market. It cannot win merely by invoking a famous algorithm or a nostalgic token. Nor should buyers accept every “AI-powered” label without examining the decision it improves. RSA's credible advantage is accumulated experience in environments where a login failure becomes an operational event.

The little fob was never lovable, exactly. It was legible. You possessed it, the number changed, the system checked. RSA's current challenge is to preserve that clarity while the evidence of identity spreads across phones, passkeys, risk engines, browsers, directories and support calls. If it succeeds, the password can disappear without trust becoming invisible.