What breaks when passkeys can still be enrolled through weak proofing steps?

The passkey no longer protects the account at the moment that matters most. If an attacker can reach enrollment through SMS, push approval, or helpdesk social engineering, they can bind their own authenticator to the account and turn a phishing-resistant login method into persistent access. The control failure is bootstrap trust, not cryptography.

Why This Matters for Security Teams

Weak proofing at passkey enrollment turns a phishing-resistant authenticator into a weak link in account recovery. The security property of passkeys is strongest at authentication time, but that strength is lost if an attacker can get through SMS, push approval, or helpdesk workflows and bind a new device to the account. This is a bootstrap problem: the cryptography is sound, but the identity proofing is not.

That distinction matters because attackers do not need to break WebAuthn to win. They only need one enrollment path that still relies on legacy signals that are easy to intercept, socially engineer, or proxy. Current guidance from the NIST Cybersecurity Framework 2.0 reinforces that identity assurance must be managed as part of the broader control environment, not treated as a one-time login upgrade. NHIMG’s Ultimate Guide to NHIs makes the same operational point in a different domain: once an attacker gains a durable binding to an identity, downstream controls often become far less effective than teams expect. In practice, many security teams encounter passkey abuse only after a helpdesk exception or fallback path has already been used to seed persistent access.

How It Works in Practice

Passkeys protect the authentication ceremony, but they do not automatically fix the enrollment ceremony. If an organisation allows new passkeys to be added after SMS OTP, push fatigue approval, email magic links, or support-mediated recovery, the attacker targets the weakest proofing step and registers their own authenticator. After that, the account may look “upgraded” to phishing-resistant login while remaining compromised.

The practical control stack is less about the credential itself and more about the strength of binding and recovery:

• Require high-assurance proofing before first passkey enrollment and before adding a new device.
• Use step-up checks for high-risk changes, especially account recovery, device rebind, and factor reset.
• Restrict helpdesk actions with strong operator authentication, approvals, and tamper-evident logging.
• Prefer hardware-bound or device-bound authenticators where policy allows, and shorten the window for recovery tokens.
• Continuously monitor for risky enrollment patterns, such as rapid factor changes or enrollment from new geographies.

The IETF WebAuthn Level 3 family of standards supports strong authentication, but it does not eliminate the need for secure lifecycle governance around account recovery and factor management. That is why NHIMG’s research on Ultimate Guide to NHIs remains relevant: durable identity binding is the real prize attackers seek, whether the subject is a human account or a non-human identity. These controls tend to break down in large service desks and federated environments because recovery exceptions, delegated administration, and inconsistent assurance levels create multiple paths to the same account.

Common Variations and Edge Cases

Tighter enrollment controls often increase user friction and support overhead, so organisations have to balance recovery speed against the risk of account takeover. Best practice is evolving here: there is no universal standard for every recovery scenario, but there is broad consensus that weaker proofing should not be allowed to mint a new primary authenticator without strong compensating controls.

Edge cases deserve special attention. Break-glass accounts may need separate recovery design. B2B federation can complicate passkey rollout when the relying party trusts an upstream identity provider that still uses weak proofing. Shared devices, call centres, and executive support channels also create pressure to bypass the normal enrollment workflow. In those cases, the right response is usually not to abandon passkeys, but to raise assurance for enrollment and recovery above the assurance used for routine sign-in.

NHIMG’s Ultimate Guide to NHIs highlights a related lesson: once a durable credential is issued without strong governance, remediation is much harder than prevention. For identity teams, the operational rule is simple. A passkey is only as strong as the weakest way an attacker can add, reset, or replace it.

Related resources from NHI Mgmt Group

• What breaks when identity proofing is weak?
• What breaks when access is managed through too many manual steps?
• What breaks when authorization is still handled through static RBAC for AI systems?
• Why do weak passwords still matter if an organisation is moving to passkeys?