Modern access is breaking out of the browser. People connect from home, hotels, airports, and new offices. They use Wi‑Fi, VPN, and SSH to reach what they need to do their jobs. If those connections still rely on passwords, shared Wi‑Fi keys, and long-lived VPN secrets, your attack surface grows every time you add a new person or device.
Here, we will walk through how cloud-based NAC can bring true passwordless trust to all those access paths. We will focus on how certificates and passkeys are issued and managed, how device attestation works in real time, and how recovery flows stay strong without falling back to shared secrets. Our goal is simple: help you see what a practical, production-ready architecture really looks like.
Building Passwordless Trust Across Every Enterprise Connection
Zero trust cannot stop at web apps. When contractors, seasonal staff, and remote workers flood in, the first thing they touch is usually Wi‑Fi, then VPN, then maybe SSH. If those doors still open with passwords or shared keys, your risk is already high before anyone signs in to a single SaaS app.
Cloud NAC for passwordless means moving the trust decisions for network access into the cloud. Instead of local RADIUS servers holding static secrets, a cloud-based NAC platform becomes the central brain that:
- Knows user identity and role
- Knows device identity and health
- Issues and checks strong cryptographic credentials
This approach removes shared secrets and long-lived passwords from Wi‑Fi, VPN, and SSH. In their place, we use certificates, passkeys, and device trust signals that can be updated, revoked, and tuned in real time.
Why Cloud-Based NAC Is the New Passwordless Backbone
In a cloud-based NAC model, the platform sits at the center of every access decision. When a laptop connects to corporate Wi‑Fi, or a contractor fires up a VPN, or an engineer opens an SSH session, the NAC platform is there in the background, making the call to allow, limit, or block.
Legacy setups often look like this:
- On‑prem NAC appliances in each main office
- RADIUS servers using static pre‑shared keys
- Local AD groups tied to flat VLANs
- Manual config for every new site or branch
By contrast, a cloud-based NAC model focuses on:
- Short-lived certificates and passkeys instead of passwords
- Dynamic policies that look at user, device, and context
- Continuous posture checks instead of one-time approval
This shift is a big help during busy seasons. When you need to onboard many contractors or open a new site fast, you do not want to rack boxes, ship hardware, or hand out Wi‑Fi passwords. With cloud NAC, you enroll users and devices into a single platform and let policies follow them wherever they connect.
Inside Certificate and Passkey Lifecycle for Passwordless Access
To get passwordless access working across Wi‑Fi, VPN, and SSH, we have to start with how we bind identity to cryptographic keys. The idea is simple: a person and a device each get their own key material, and that key becomes the way they prove who they are.
A cloud-based NAC platform typically manages this like so:
- At enrollment, a key pair is created on the device or authenticator
- A certificate is issued that ties that key to a user and device record
- The certificate is trusted by Wi‑Fi controllers, VPN gateways, and SSH systems
Lifecycle matters just as much as initial issuance. Good passwordless architecture bakes in:
- Automated renewal before certificates expire
- Regular rotation of keys to limit blast radius
- Immediate revocation when a device is lost or a role changes
- Short-lived session credentials for actual Wi‑Fi, VPN, and SSH connections
Because the NAC platform is in the cloud, it can connect to sources like cloud directories, HR systems, and MDM or EDR tools. That means when someone changes teams, leaves the company, or wipes a device, their certificates can be adjusted without opening tickets or waiting on manual work by IT.
Device Attestation That Goes Beyond Basic Compliance Checks
Passwords do not care what device you are on. Passwordless should. Device attestation is how we confirm a device is the same one we enrolled earlier and that it is still in a healthy state for access.
We can think of attestation as two buckets of checks:
Static signals, such as:
- OS version and patch level
- Disk encryption status
- Presence of approved EDR
- Secure boot or trusted boot
- Jailbreak or root detection
Dynamic signals, such as:
- Active firewall state
- Suspicious processes running
- Recent EDR alerts
- Network location or IP reputation
These checks feed into posture scores or policy tags. The cloud-based NAC then uses that posture in different ways per access channel:
- Wi‑Fi: map healthy devices to production VLANs or microsegments, and send risky ones to limited networks
- VPN: adjust which internal apps someone can see based on current device health
- SSH: only allow SSH keys or sessions from devices that pass attestation, and log posture at the time of access
The result is that trust is not only about who the user is, but also about what they are holding in their hands at that moment.
No-Shared-Secret Recovery and Fallback Flows That Actually Scale
Loss and replacement of devices is where many passwordless projects fall apart. People lose a laptop right before a big deadline. A phone gets dropped in water. A whole group of seasonal staff turns over between shifts. Old habits return fast: send a temporary password, share the Wi‑Fi key, email a magic link.
Traditional recovery tools rely on shared secrets such as:
- Backup passwords
- Shared Wi‑Fi passphrases
- VPN pre‑shared keys
- Security questions with guessable answers
- Emailed one-time codes that can be phished
A modern, no‑shared‑secret approach focuses on stronger signals, like:
- Identity proofing flows, possibly with admin review
- Step‑up MFA with hardware security keys or trusted platform authenticators
- Admin-approved re‑enrollment that issues new device certificates
- Time-bound, scoped certificates for temporary access while full setup finishes
Because a cloud NAC platform sees Wi‑Fi, VPN, and SSH together, it can coordinate these recovery steps in a uniform way. That means when a staff member gets a replacement laptop during a busy season, they follow one consistent, strong process, not three weaker ones for three different systems.
Unifying Wi‑Fi, VPN, and SSH Under One Zero Trust Roof
When all these pieces come together, you get a single control plane for access. The cloud-based NAC talks RADIUS to Wi‑Fi and VPN, and it can integrate with SSH gateways or bastions that trust the same certificates and passkeys.
Think about three common types of users:
- A full-time engineer who needs Wi‑Fi, VPN, and SSH to production
- A contractor who only needs VPN into a specific app set
- A seasonal worker who only needs Wi‑Fi and one SaaS portal
With one policy engine, you can give each person:
- A clean enrollment flow that issues the right certificates or passkeys
- Device attestation rules tuned to their risk and needs
- Access policies that follow them across Wi‑Fi, VPN, and SSH without reintroducing passwords
Operationally, this central model makes life easier for IT and security. You get one set of logs, one place to change policies, and one source of truth for which user and device had access to what. When regulations or threat patterns change, you update rules once and let the cloud platform push those decisions everywhere.
Moving From Passwordless Pilots to Production-Grade Cloud NAC
To move from a small passwordless pilot to an organization-wide reality, it helps to think in building blocks. You need:
- A cloud-based NAC that can act as the trust brain for Wi‑Fi, VPN, and SSH
- Strong certificate and passkey lifecycle management
- Device attestation deep enough to handle real risk, not just basic compliance
- Recovery paths that do not fall back to passwords or shared secrets
A practical way to roll this out is step by step. Many teams start with certificate-based Wi‑Fi, since that is often the biggest surface area. Next, they extend the same identity, device, and certificate flows to remote VPN. After that, they bring SSH under the same roof, so engineers and admins use the same trust fabric as everyone else. At each stage, they layer in better device attestation and tighten recovery flows so that strong security and daily work stay in balance.
At Portnox, we focus on helping organizations make this shift to cloud-native zero-trust access in a way that works for busy IT and security teams. As seasonal demands and hybrid work keep stretching traditional models, now is a good time to look closely at where shared secrets are still hiding in your environment and how a cloud-based NAC platform can help you finally retire them.
Secure Every Connection With Simple, Scalable Control
If you are ready to move beyond legacy hardware and gain visibility into every device on your network, our cloud-based NAC is built to make that transition straightforward. At Portnox, we focus on helping you enforce consistent access policies across all locations without adding complexity for your IT team. Let us show you how quickly you can strengthen your security posture with a cloud-native approach. If you would like tailored guidance for your environment, please contact us to start the conversation.