Passkeys are here. What should organisations do next?

Passwords have been part of working life for so long that businesses have built an entire security ecosystem around their weaknesses. Password managers help people create and store strong passwords. Multi-factor authentication adds another layer of verification. Account lockouts and password resets deal with the inevitable moment when someone selects ‘forgot password’.

But the fundamental problem remains: passwords are secrets that people have to manage, and secrets can be forgotten, reused, stolen or handed over to the wrong person. Passkeys offer organisations an opportunity to change that model.

Built on FIDO2 standards, passkeys use public key cryptography instead of asking a user to enter a shared secret. The National Cyber Security Centre (NCSC) now recommends choosing passkeys over passwords where they are available, assessing FIDO2 credentials, including passkeys, as secure or more secure than traditional multi-factor authentication against common credential attacks.

That makes the business conversation around passkeys increasingly less about whether the technology has potential and more about what organisations should do with it.

For most businesses, the answer will not be to replace every password immediately. It will be to understand where credentials create risk today, where passkeys can provide stronger protection and how to move towards phishing-resistant authentication without creating new operational problems in the process.

If you are reading this because your organisation has experienced a cyber incident and is unsure how to respond, contact Zensec immediately.

Why passwords remain a security problem

Good password management can reduce risk. A password manager can generate strong, unique passwords, helping to prevent people using the same password across multiple accounts. Multi-factor authentication (MFA) can make it more difficult for an attacker to gain access when a password is compromised. But those controls are still compensating for weaknesses inherent in traditional passwords.

People reuse passwords. Weak passwords can be vulnerable to brute force attacks. Credentials can be exposed in data breaches. Passwords can also be entered into a fake website during a phishing attack.

Even traditional MFA does not necessarily eliminate that final problem. The NCSC notes that passwords combined with methods including SMS codes, email codes, time-based one-time passwords and push approvals remain inherently phishable.

For businesses, this also creates operational friction. Password policies need managing, users forget credentials and password resets need a recovery process which verifies the legitimate user without giving an attacker another route into the account.

A stronger password is still a password. Passkeys represent an opportunity to change the authentication process itself.

What actually changes with passkeys?

Despite the name, a passkey is not another type of password that users have to remember.

Passkeys are cryptographic credentials based on FIDO standards. When a passkey is created for an online service, public key cryptography generates a cryptographic key pair. The service holds the public key while the corresponding private key is securely managed through the user’s passkey provider. Authentication takes place using those cryptographic keys rather than transmitting a password to the service.

For the user, the experience can be much simpler than the technology underneath it. Instead of typing a password and perhaps a verification code sent by text message, the user may be prompted to unlock their device using a device PIN, fingerprint or facial recognition. Familiar capabilities such as Face ID and Windows Hello can therefore form part of a passwordless sign-in experience without requiring users to understand the cryptography behind it. This distinction matters.

With passwords, a user knows something that an attacker can attempt to steal. With a correctly implemented passkey, there is no reusable password for the user to disclose.

Why phishing-resistant authentication matters

The fact that passkeys are phishing resistant is perhaps more important than removing the need to remember passwords.

Many phishing attacks depend on persuading someone to enter genuine credentials into a fake website. The victim may believe that they are signing into a familiar online service, while an attacker captures their password and, in some cases, a second authentication factor.

Passkeys work differently. FIDO authentication uses cryptographic credentials associated with the relevant website or application, rather than a secret which a user manually enters. The NCSC says passkeys cannot be intercepted, reused or stolen in the way passwords can, while the FIDO Alliance describes FIDO standards as using public key cryptography to provide phishing-resistant authentication.

That can significantly change the economics of credential theft.

It does not make an organisation immune to phishing or every form of account compromise. Attackers can still target users through social engineering, attempt to hijack active sessions or look for weaknesses elsewhere in the authentication and recovery process. The NCSC explicitly considers session hijacking alongside phishing and credential reuse when assessing authentication security.

Passkeys fix an important credential problem. They do not fix every security problem. That is why organisations should approach adoption as an identity and access decision, not simply a new login feature.

Don’t try to remove every password at once

For many organisations, the practical future is likely to be hybrid for some time. Some online services and corporate resources will support passkeys. Others will continue to rely on traditional passwords. Older applications may have authentication dependencies that are difficult to change, and shared devices can introduce different requirements from devices assigned to individual employees.

The FIDO Alliance itself recommends a staged journey towards stronger phishing resistance, noting that an immediate switch can introduce user friction. Its guidance also identifies a partial-prevention approach in which passkey-only authentication can initially be targeted at higher-risk users or functions.

That suggests a more useful question than ‘How quickly can we get rid of passwords?’. Ask instead:

Where does password-based authentication create the greatest risk in our current setup, and where can we remove that exposure first?

That may lead an organisation to prioritise administrators, high-value systems, people with access to sensitive information or groups frequently targeted by phishing attacks. The goal should be a controlled reduction in reliance on phishable credentials rather than a rushed passwordless programme.

Start with identity, not individual applications

Before enabling passkeys wherever a ‘support passkeys’ option appears, organisations should understand how authentication currently works across their environment. That means looking at the identity provider, single sign-on, existing MFA controls, device management, privileged access and the applications employees use every day.

Microsoft Entra ID, for example, supports FIDO2 passkeys stored in several forms, including FIDO2 security keys, native or third-party passkey providers and Microsoft Authenticator. Its passkey profiles can also apply different requirements to different user groups, including choices around device-bound or synced passkeys and restrictions on permitted authenticators.

Windows Hello can act as a local credential container for Microsoft Entra passkeys on Windows, protected by user verification such as a PIN, fingerprint or facial recognition. Importantly, Microsoft distinguishes these FIDO2 passkeys from Windows Hello for Business credentials, even though both can use Windows Hello technology.

The exact implementation will depend on the organisation’s technology estate. The principle is broader: create an authentication strategy rather than a collection of isolated passkey deployments.

Decide where passkeys should make the biggest difference

A sensible rollout starts with risk rather than convenience. Organisations should map the accounts, users and systems where credential theft would have the greatest impact. Privileged accounts are an obvious consideration, but they are not the only one. Access to sensitive business information, cloud administration, finance systems and other high-value corporate resources may warrant stronger protection. The organisation can then assess where passkeys are both supported and operationally appropriate.

For businesses using Microsoft Entra ID, for example, Microsoft documents the option of applying passkey profiles to particular groups and creating Conditional Access authentication strength policies that require passkeys for sensitive resources.

This makes a phased adoption model possible:

• identify users and services most exposed to phishing and credential theft;
• confirm device and platform support;
• test enrolment and day-to-day authentication with a controlled user group;
• strengthen authentication for higher-risk resources first;
• monitor support issues and recovery scenarios before expanding adoption; and
• progressively reduce phishable authentication options as confidence grows.

A small business may take a much simpler approach than a large enterprise, but the principle is the same. Prioritise security outcomes rather than measuring success by the raw number of passkeys issued.

Don’t let account recovery become the weak link

Successful authentication is only one part of account security. What happens when somebody loses their phone? What happens when a laptop is replaced? How does the organisation verify somebody’s identity if their usual passkey is unavailable? These aren’t reasons to avoid passkeys. They are reasons to design the recovery process carefully.

If normal sign-in uses phishing-resistant authentication but account recovery falls back to a weak verification process, attackers have an incentive to target the recovery route instead.

The FIDO Alliance specifically highlights account recovery as part of the journey towards comprehensive phishing resistance, including the possibility of attackers exploiting recovery mechanisms to bypass stronger passkey authentication.

Organisations should therefore define recovery alongside rollout. That includes considering how additional passkeys are registered, how lost devices are handled, how access is revoked, which alternative authentication mechanisms remain available and who is authorised to perform sensitive recovery actions.

There is little benefit in strengthening the front door if a forgotten-password or recovery workflow leaves a side entrance open.

Plan for the people as well as the technology

Passkeys can reduce friction once users understand them, but changing a familiar sign-in process still requires communication.

People need to know what they are being asked to do when prompted to create a passkey, where that credential will be stored and why they may be asked to use a fingerprint, facial recognition or device PIN to authenticate. This becomes especially important in an environment where passkeys and passwords coexist.

A user may have a passkey for one service, a password manager for another and a security key for particularly sensitive access. Without clear guidance, the organisation risks turning a security improvement into confusion.

Communication should therefore form part of deployment. Explain the change in practical terms: you are replacing a secret that can be forgotten or phished with a credential securely managed through an approved device or passkey provider. Then make sure service desk teams understand the recovery and support model before the wider user base does.

Passwordless should be a direction, not a deadline

Passkeys offer a credible route to stronger authentication, but adopting them well requires more than switching on a feature.

Organisations need a clear picture of their existing identity environment, the corporate resources they need to protect, which platforms support passkeys and where passwords or weaker authentication methods will remain. Recovery, device management and user experience need to be considered alongside the cryptography.

The direction of travel is becoming clearer. The NCSC now recommends passkeys wherever services support them, while established platforms are expanding enterprise support for phishing-resistant credentials.

For security leaders, that makes now a useful time to review the current setup and decide where the transition should begin.

The objective is not simply to replace passwords because a newer technology has arrived. It is to reduce the opportunities attackers have to steal, reuse or trick users into surrendering the credentials that provide access to your organisation.

Passkeys give businesses an opportunity to do exactly that. The next step is making sure they are introduced in the right places, with the right controls around them.