Users can be locked out if they lose a registered device and the organisation has no safe recovery path. In practice, that turns a stronger authentication control into an availability problem, especially for sensitive applications and remote access. Secure fallback methods, such as verified one-time passcodes or administrator-assisted recovery, are needed to preserve access without weakening assurance.
Why This Matters for Security Teams
FIDO2 is strong because it reduces phishing and password replay risk, but it does not eliminate identity recovery risk. If a user loses every registered authenticator and the organisation has no secure fallback, the result is often a lockout that becomes a business continuity issue. That is especially painful for remote staff, administrators, and regulated workflows where delayed access can stop operations. Guidance from NIST SP 800-63 Digital Identity Guidelines and NHI governance material in the Ultimate Guide to NHIs both point to the same practical truth: assurance only works when recovery is designed with equal care.
Security teams often treat passkey rollout as a pure authentication upgrade, then discover that the weak point is not login but recovery, lifecycle, and helpdesk process design. In practice, many organisations encounter account lockouts only after a device loss event has already interrupted access.
How It Works in Practice
A secure FIDO2 deployment should assume that authenticators will be replaced, damaged, or unreachable. The design goal is not just strong primary login, but a recovery path that preserves assurance without creating a bypass. Current guidance suggests using a layered model: one or more FIDO2 credentials, a verified fallback channel, and an administrative recovery workflow that is logged, time-bound, and subject to step-up checks.
Common patterns include:
- Enrollment of multiple authenticators, such as a platform passkey plus a roaming security key.
- Recovery codes stored separately from the device, with clear handling rules.
- Verified one-time passcodes or identity proofing when a registered authenticator is unavailable.
- Helpdesk-assisted recovery with strong identity verification, ticketing, and approval records.
- Step-up checks before restoring access to privileged or sensitive applications.
From a control perspective, this is about balancing phishing resistance with recoverability. NIST CSF 2.0 emphasizes governance and recovery planning, while NIST SP 800-53 Rev. 5 supports strong identification, authentication, and system access controls. The Ultimate Guide to NHIs is useful here because it frames identity security as a lifecycle problem, not a single login event. These controls tend to break down in highly distributed organisations where support teams lack a consistent way to verify identity across regions and device types.
Common Variations and Edge Cases
Tighter authentication often increases operational overhead, requiring organisations to balance phishing resistance against recovery friction. That tradeoff becomes sharper for executives, contractors, shared workstations, and emergency access scenarios, where normal user assumptions do not hold.
There is no universal standard for FIDO2 recovery yet, so practice varies. Some organisations allow backup passkeys stored on a second device, while others rely on identity proofing through a helpdesk or identity provider. The key is that fallback must be stronger than ordinary password reset, because a weak recovery path can undo the protection FIDO2 was meant to provide.
Edge cases include lost devices during travel, employees who never enrolled a second authenticator, and break-glass access for administrators. In those situations, organisations should predefine whether recovery is self-service, helpdesk-mediated, or manager-approved, and should log the event as a security-sensitive action. Where FIDO2 is deployed without these guardrails, the failure mode is often not compromise but prolonged denial of access.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Covers authenticators, recovery, and assurance levels for digital identity. | |
| NIST CSF 2.0 | PR.AA | Identity and access controls must include resilient recovery and administration. |
| NIST SP 800-53 Rev 5 | IA-2 | Strong authentication still needs controlled reauthentication and account recovery processes. |
| OWASP Non-Human Identity Top 10 | NHI-07 | Identity lifecycle failures often emerge when credential recovery is not governed. |
| NIST AI RMF | Risk management should include usability and access-loss impacts from auth design. |
Align FIDO2 rollout with identity assurance and define recovery paths that preserve authenticator strength.
Related resources from NHI Mgmt Group
- What breaks when n8n is deployed without persistent storage and proper production controls?
- What breaks when security teams rely on passkeys without removing weaker account recovery options?
- What breaks when Okta tenant recovery has never been tested against the live environment?
- What breaks when tenant configuration recovery is not in place for identity platforms?
