FIDO2 passkey management shifts the control plane for human IAM

At a glance

What this is: Versasec argues that FIDO2 passkeys move enterprise authentication toward hardware-bound, phishing-resistant control, but the operational burden shifts into lifecycle management.

Why it matters: IAM teams should treat passwordless as a governance change, not just an authentication upgrade, because issuance, revocation, recovery, and audit become the control plane.

By the numbers:

• Phishing causes 70% of data breaches, according to Microsoft’s Digital Defense Report cited by Versasec.

Context

Passwords and traditional MFA remain easy targets because they can be phished, reused, or bypassed in ways that leave the identity team reacting after the fact. In a human IAM programme, that makes authentication strength only part of the problem; credential governance and recovery processes matter just as much.

This post is really about the control shift created by device-bound FIDO2 passkeys in Microsoft Entra ID. The security gain comes from moving the private key onto hardware, but the operational challenge moves to provisioning, lifecycle control, and evidence that passkeys are managed consistently across the tenant.

Key questions

Q: How should IAM teams govern passkeys across multiple platforms?

A: Treat passkeys as lifecycle-managed authenticators, not as a one-time login feature. Define where they are stored, how they sync, who can share them, and how they are deleted during offboarding. The main failure mode is inconsistent control across Apple, Google, and Microsoft ecosystems, which creates invisible governance drift even when the user experience looks seamless.

Q: Why do credentials create less risk than passwords but more governance work?

A: Credentials are harder to guess or reuse than passwords, so they reduce the weakness of knowledge-based authentication. But they also multiply governance obligations because every certificate, key or token needs issuance, tracking, rotation and revocation. The security gain only holds if lifecycle operations keep pace with the estate.

Q: What breaks when passkey recovery is not governed properly?

A: The programme falls back to the weakest legacy recovery path, which attackers often target first. If help-desk verification, device replacement, or fallback login is inconsistent, the user can still be phished or socially engineered even when the primary login is passkey-based.

Q: Should organisations require passkeys for privileged accounts?

A: Yes, where account compromise would have high impact, privileged accounts should move first. That does not mean forcing every user through the same policy on day one. It means tying the strongest authentication requirement to the highest-risk identities, then supporting adoption with clear instructions and a controlled fallback strategy.

Technical breakdown

Why device-bound passkeys change the authentication trust model

A device-bound FIDO2 passkey stores the private key on a physical authenticator and uses public-key cryptography for sign-in. The private key never leaves the device, so phishing pages cannot steal a reusable secret the way they can with passwords or OTP-style workflows. That materially changes the attack surface because authentication becomes tied to possession of the device plus the local cryptographic operation, rather than a memorisable secret the user types into a potentially hostile prompt. In enterprise terms, the trust boundary moves from the user’s memory to the managed authenticator and its lifecycle.

Practical implication: Model passkeys as hardware-managed identity assets and define who can issue, replace, and revoke them.

Why passwordless still needs lifecycle governance

Passwordless does not eliminate identity administration. It changes the object being governed from a password or MFA token to a device-bound authenticator that must be issued, protected, inactivated, reissued, and audited. If an employee changes devices, loses the key, or leaves the organisation, the passkey lifecycle matters as much as traditional offboarding used to matter for passwords. That is why centralized management and audit trails are operational requirements, not convenience features. Without them, the enterprise may reduce phishing exposure while creating unmanaged credential sprawl in a new form.

Practical implication: Treat passkey issuance and revocation as standard identity lifecycle events, with audit evidence attached.

How hybrid credential estates complicate rollout

Many enterprises will run passkeys and certificates side by side during transition, especially where legacy applications or device types still depend on traditional credentials. That creates a hybrid authenticator estate, where one device can hold more than one trust model and the identity team has to govern both together. The risk is not just technical incompatibility; it is inconsistent policy enforcement across user groups, devices, and recovery paths. Central administration matters because the rollout is rarely all-or-nothing, and mixed environments tend to expose gaps in exception handling and recovery design.

Practical implication: Inventory which applications and user populations still depend on certificates or passwords before expanding passkey policy.

Threat narrative

Attacker objective: Obtain reliable enterprise account access without needing the victim’s device-bound authenticator.

1. Entry begins with phishing that captures a password or other reusable secret before the user reaches a legitimate service.
2. Credential use then succeeds because the attacker can replay or bypass weaker authentication flows that are not hardware-bound.
3. Impact follows as the attacker gains account access that can be used for data theft, fraud, or further internal compromise.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Device-bound passkeys shift the centre of gravity from authentication strength to credential governance. The important change is not that enterprises stop managing identity assets. It is that the managed asset becomes a hardware-bound authenticator whose issuance, custody, revocation, and audit trail define control quality. Practitioners should stop thinking of passwordless as an end state and start treating it as a new governance surface.

Passwordless succeeds only when lifecycle control is as mature as sign-in policy. A passkey that cannot be reissued cleanly, revoked quickly, or traced through an audit log simply recreates old IAM problems in a different form. The governance lesson is that stronger cryptography does not remove operational accountability; it makes accountability more visible. Teams need lifecycle precision, not just better login prompts.

FIDO2 passkeys expose the weakness of authentication programmes that separate user experience from control ownership. In human IAM, usability and security are often treated as competing goals. Passkeys show that they are coupled: if recovery, help desk, and device replacement are not designed together, the programme becomes brittle. The real control plane is the process around the authenticator, not the authenticator alone.

Hybrid credential estates are the transitional risk most teams underestimate. Enterprises rarely replace every password or certificate at once, so policy, recovery, and audit must work across mixed state for a long period. That is where governance failures appear, because exception handling often lives outside the main identity programme. Identity leaders should assume mixed-mode operations will last long enough to matter.

Hardware-backed authentication does not reduce the need for identity evidence. A good passkey rollout should make it easier to prove who can authenticate, which device holds the credential, and whether revocation actually happened. That aligns with NIST SP 800-63 and Zero Trust thinking, where authentication assurance is only useful if the surrounding lifecycle is trustworthy. Practitioners should measure the control plane, not just the login event.

What this signals

Passwordless changes the governance problem before it changes the user experience. If the programme treats passkeys as a one-time authentication project, the control plane will remain incomplete. The enterprise needs operational ownership for issuance, revocation, and reissue, because that is where assurance either holds or leaks away.

Device-bound authentication is only as strong as the recovery path around it. Lost-device handling, help desk identity proofing, and audit evidence become the practical determinants of whether the rollout improves security or simply moves failure into a different workflow.

For practitioners

• Define passkey lifecycle ownership Assign clear ownership for issuance, replacement, revocation, and audit of device-bound passkeys so the credential does not become an unmanaged asset.
• Pilot with privileged users first Start with administrators and other high-risk accounts where phishing resistance produces the most immediate reduction in account takeover exposure.
• Map hybrid authenticator dependencies Document which user groups, applications, and recovery paths still rely on passwords or certificates before enforcing broad passkey policy.
• Tighten recovery and reissue workflows Make lost-device handling, PIN unblock, and credential reissue part of the normal identity workflow rather than ad hoc help desk actions.
• Build an audit trail for authenticator changes Record who issued, revoked, inactivated, or reissued each passkey so lifecycle evidence is available for governance and compliance reviews.

Key takeaways

• FIDO2 passkeys reduce phishing exposure by tying authentication to hardware, but they do not remove the need for identity governance.
• The main operational shift is from password control to authenticator lifecycle control, including issuance, revocation, reissue, and audit.
• Teams that pilot passkeys without recovery design and hybrid-credential planning risk creating a stronger login path around a weaker control plane.

Key terms

• Device-Bound Passkey: A device-bound passkey is a FIDO credential tied to one physical device and generally stored in hardware-backed secure components. The value for enterprise security is lifecycle control, because the credential is easier to inventory, constrain, and revoke without relying on cloud sync paths.
• Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Hybrid Identity Estate: A hybrid identity estate combines cloud and on-premises identity systems under one operational environment. For NHIs, this usually means certificates, service principals, and service accounts are distributed across tools and teams, which makes visibility and lifecycle enforcement harder unless controls are centralised.

Deepen your knowledge

NHI governance, human identity, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or human IAM in your organisation, it is worth exploring.