FIDO2 passkeys do not close the enterprise authentication gap

At a glance

What this is: This is an analysis of why FIDO2 passkeys improve login security but do not by themselves close enterprise authentication gaps around device control, revocation, and session-layer attacks.

Why it matters: IAM and security teams need to treat passkeys as one control in a broader identity architecture, not as a complete replacement for device trust, lifecycle enforcement, and continuous session validation.

Context

Passkeys remove passwords from the login step, but enterprise authentication is broader than sign-in. In corporate environments, the real problem is not just whether the initial factor is phishing-resistant, but whether organisations can see, govern, and revoke device-bound access across its full lifecycle.

The gap appears when a consumer-designed control is applied to enterprise identity without the surrounding governance model. Once the session starts, authentication no longer protects against token theft, session hijacking, OAuth consent abuse, or browser-based interception, so identity teams have to think beyond first-factor replacement.

Key questions

Q: What breaks when passkeys are treated as a full replacement for authentication assurance?

A: What breaks is the assumption that a phishing-resistant sign-in method automatically satisfies every access requirement. Passkeys reduce secret theft, but assurance still depends on device binding, recovery design, and whether the organisation allows synced credentials for the target application or transaction.

Q: Why do passkeys still leave organisations exposed to phishing attacks?

A: Passkeys reduce phishing risk only when they are the sole usable method. If passwords, backup codes, OTP, or other legacy methods remain active, attackers can downgrade the session to one of those paths. The exposure is created by the account’s remaining authentication surface, not by the passkey itself.

Q: What are the signs that passkey adoption is not yet ready for enterprise scale?

A: Passkey readiness is still incomplete when organisations face uncertainty about standards, manual credential management, high issuance and recovery effort, and uneven compatibility across multiple IAM systems. Those are practical indicators that rollout will be operationally expensive or inconsistent. Teams should look for a deployment model that reduces administration before expanding passkeys broadly.

Q: Should organisations prioritise session controls or more authenticators after moving to passkeys?

A: Session controls should come first once password risk is reduced. More authenticators do not solve token theft, replay, or consent phishing if the session remains trusted after login. The better investment is continuous validation, device-bound access, and revocation that actually ends risk when the device or user context changes.

Technical breakdown

Why FIDO2 passkeys stop at the login boundary

FIDO2 passkeys are designed to authenticate a user to a service using a public-key challenge-response flow, usually tied to a device or platform authenticator. That makes them strong against phishing because the secret never leaves the authenticator and cannot be reused as a password can. But the design goal is bounded: it proves the user at sign-in. After the assertion is accepted, the relying party issues a session or token, and the passkey itself is no longer part of subsequent authorization decisions.

Practical implication: treat passkeys as login hardening, not as a complete session-security control.

Why enterprise identity breaks the consumer passkey model

Consumer passkeys assume the account owner controls their own devices and can add or remove authenticators with minimal oversight. Enterprise identity is different: administrators need provisioning control, device compliance checks, privileged access boundaries, and fast revocation when risk changes. When passkeys are deployed without central device governance, organisations often compensate with MDM and IdP policy layers, but that creates fragmented enforcement and inconsistent visibility across managed and unmanaged devices.

Practical implication: align passkey deployment with device governance and identity policy, not only with user authentication flows.

How post-login attacks bypass even strong authentication

Once a session token exists, attackers do not need to defeat the authenticator. They can steal tokens, hijack active sessions, replay browser state, or abuse OAuth consent flows to obtain access through the application layer instead of the factor layer. In those cases, the weak point is not credential strength but the lack of continuous trust validation after authentication. The security model has to extend into the session, where device state and token use can still be challenged.

Practical implication: add continuous session validation and revocation logic for risks that occur after sign-in.

NHI Mgmt Group analysis

FIDO2 passkeys solve phishing, not enterprise authentication governance. The control addresses one moment in the identity lifecycle, but enterprise risk is distributed across enrolment, device trust, session issuance, and revocation. That means the programme question is not whether passwords disappear, but whether governance still exists after sign-in. Practitioners should judge passkeys by the controls they leave untouched.

Consumer authentication assumptions collapse in corporate environments. The consumer model assumes the user owns the device, decides when to add authenticators, and can tolerate privacy-preserving device opacity. Enterprise identity assumes the opposite. That mismatch creates a governance gap where central policy must be reconstructed around a control that was not designed for admin-led lifecycle enforcement.

Session security becomes the real boundary of identity protection. If authentication ends when a token is issued, then token theft, browser hijacking, and consent abuse become the new high-value attack surface. Passkeys can improve the front door, but they do not remove the need to govern what happens after entry. The implication is that identity programmes must shift from login assurance to session assurance.

Identity blast radius is now determined by revocation speed and device truth. A strong authentication factor means little if compromised sessions persist or unmanaged devices can still enroll credentials without reliable visibility. The decisive control is not the factor alone, but the organisation’s ability to bind access to trusted devices and terminate it cleanly when trust changes. Practitioners should measure the speed and completeness of revocation, not just login resistance.

FIDO2 should be treated as one layer in a zero standing trust model. In enterprise settings, ephemeral access decisions, device posture, and session validation need to work together. The market is moving toward architectures that preserve the phishing resistance of passkeys while reintroducing the governance controls enterprises never had a reason to abandon. Practitioners should evaluate whether their authentication stack is actually integrated with identity lifecycle control.

What this signals

Passkey programmes need to be judged by the control boundary they create. If the design only improves sign-in, then the organisation has not reduced identity risk so much as relocated it to the session layer and device lifecycle. The next maturity step is deciding which access decisions must remain valid after authentication and which must be re-verified continuously.

Device truth matters as much as factor strength. Enterprises cannot rely on a consumer-style model where the authenticator is enough and device context stays hidden. Once unmanaged endpoints, shared devices, or inconsistent renewal paths enter the picture, the authentication programme becomes a governance problem, not just a login problem.

For practitioners

• Map passkey coverage to enterprise control gaps Identify where FIDO2 removes password risk but leaves unmanaged device enrollment, session persistence, or inconsistent policy enforcement unresolved.
• Tie authentication to device governance Require device compliance, owner verification, and revocation workflows to operate alongside passkey enrolment and renewal.
• Validate session-layer protections Review whether your environment detects token theft, replay, OAuth consent abuse, and browser-based hijack attempts after login.
• Measure revocation speed and completeness Test how quickly access is removed when a device is lost, compromised, or no longer managed, and confirm that stale sessions cannot persist.

Key takeaways

• FIDO2 passkeys materially improve login security, but they do not by themselves solve enterprise governance over devices, revocation, or active sessions.
• The most dangerous attacks after passkey rollout are the ones that bypass authentication entirely by abusing issued sessions and tokens.
• Enterprises should evaluate passkeys as one layer in a broader identity architecture that includes device trust and continuous session control.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• Device Compliance Enforcement: Device compliance enforcement is the process of blocking or limiting access when an endpoint no longer meets required data handling rules. It goes beyond detection, using technical controls to prevent continued access until the user fixes the issue. This is essential when sensitive data moves onto employee-managed devices.
• Continuous trust validation: Continuous trust validation is the practice of re-checking device, session, or policy conditions after initial login rather than assuming access remains safe. It is especially relevant when authentication is strong at sign-in but risk can still change during the session.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.