TL;DR: Passkeys are FIDO passwordless credentials that replace shared passwords with device-bound private keys, improving phishing resistance and user convenience across consumer and enterprise authentication, according to 1Kosmos. Passwordless adoption still changes IAM operating assumptions, especially around enrollment, recovery, and lifecycle governance.
At a glance
What this is: This is a 1Kosmos analysis of passkeys and passwordless authentication, with the key finding that device-bound FIDO credentials improve security and convenience but force IAM teams to rethink lifecycle controls.
Why it matters: It matters because passwordless authentication changes how teams enroll, recover, and govern access across human IAM and adjacent non-human workflows that still depend on strong authentication.
Context
Passkeys are passwordless authentication credentials built on FIDO standards and designed to replace shared passwords with device-bound keys. The IAM question is not whether the login flow is simpler, but how authentication, recovery, and account lifecycle controls adapt when passwords are no longer the primary secret.
For identity teams, the operational shift is larger than user experience. Passwordless adoption changes the assumptions behind onboarding, fallback access, help desk recovery, and cross-application access management, especially where consumer and enterprise journeys share the same identity layer.
Key questions
Q: How should security teams implement passkeys without creating recovery or enrollment blind spots?
A: Use passkeys as the primary phishing-resistant login method, but pair them with a verified recovery factor such as email or SMS OTP for signup and account recovery. Treat enrollment as a governed workflow, not a one-time UX choice. Keep the implementation simple, validate the session before allowing passkey management, and ensure the application can support multiple auth methods without weakening assurance.
Q: Why do passwordless programmes still need strong lifecycle governance?
A: Passwordless shifts risk from passwords to issuance, recovery, and revocation. If those lifecycle steps are slow or unclear, users lose access, request exceptions, or reuse weaker paths to keep working. Strong lifecycle governance keeps the credential trusted throughout its usable life, not just at initial enrolment.
Q: What breaks when passkeys are rolled out without strong fallback controls?
A: The recovery path becomes the easiest route into the account. If password resets, device re-binding, or support exceptions are weakly controlled, attackers will bypass the passkey itself and compromise the identity through the exception process instead of the primary login.
Q: What is the difference between passkeys and federation in IAM?
A: Passkeys are the authentication method used to prove the user at sign-in, while federation is the mechanism that lets one identity provider assert that authentication result to other services. In practice, passkeys can strengthen the first step, but federation still governs how that proof is trusted across applications.
Technical breakdown
How passkeys replace shared passwords
Passkeys use public-key cryptography rather than a memorised secret. The private key stays on the user’s device or secure authenticator, while the service stores only the public key and verifies a signed challenge at login. That removes password reuse, phishing replay, and most credential stuffing value, because there is no shared secret for an attacker to harvest and reuse. In practice, the security gain comes from binding authentication to the device and the origin, not from making the user remember a new credential format.
Practical implication: treat passkey rollout as an authentication architecture change, not a password policy tweak.
Why passwordless shifts enrollment and recovery risk
The weak point in passwordless programmes is often not the login ceremony but identity proofing, account recovery, and device replacement. If enrollment is too permissive, an attacker can bind a passkey to the wrong identity. If recovery is too loose, the fallback path becomes the new takeover route. If lifecycle governance is weak, old devices and stale recovery factors remain usable after the user has moved on. The control problem moves from password strength to trust in issuance and re-issuance.
Practical implication: govern enrollment and recovery with the same scrutiny you would apply to privileged credential issuance.
Where passkeys fit in federated IAM
Passkeys can improve local authentication while still sitting inside a broader federation model that uses IdPs, session controls, and policy decisions. That means they do not replace IAM governance, they change the mechanism used at authentication time. Teams still need to manage assurance levels, step-up access, device trust, and fallback methods across applications and user populations. For mixed environments, the main design question is where passwordless ends and where federation, session policy, and reauthentication controls begin.
Practical implication: define which apps can accept passkeys directly and which still require federation and step-up controls.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Passwordless changes the control point, not the governance problem. Passkeys reduce dependency on shared secrets, but they do not eliminate the need to govern identity proofing, recovery, and re-binding events. The operational risk simply moves from password theft to issuance trust, which is a different control surface with the same business impact if it fails. Teams should judge passkey maturity by lifecycle discipline, not by login convenience alone.
Passkey adoption is strongest where recovery is constrained and auditable. A device-bound credential is only as trustworthy as the process that binds it to the right person or account in the first place. If help desk flows or self-service recovery can recreate access without strong assurance, passwordless becomes a faster path to compromise rather than a reduction in it. The practical test is whether the recovery path is harder than the login path.
Passkeys expose the limits of password-era IAM design. Many programmes still treat authentication as a front-door event and leave enrollment, fallback, and revocation outside the core control model. That assumption no longer holds when the credential is tied to devices, users change devices frequently, and access spans consumer and enterprise contexts. The implication is that IAM teams need a lifecycle view of authentication, not a login-only view.
Passkeys create a named control gap we can call passwordless recovery debt. Organisations that move quickly to passwordless while leaving recovery, reset, and device replacement loosely governed accumulate hidden trust obligations. Those obligations are often invisible until a user loses a device, a session is hijacked, or support staff bypasses the intended assurance path. Practitioners should treat recovery design as part of the authentication control, not an administrative afterthought.
From our research library:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
What this signals
Passwordless adoption only pays off when the recovery path is stronger than the login path. Many programmes focus on phishing resistance and ignore the exception handling that attackers target next. For IAM teams, the real maturity test is whether fallback access is more tightly governed than the credential it replaces.
Passwordless changes authentication operations across human identity and adjacent enterprise access flows. The practical challenge is not just removing passwords, but ensuring device replacement, account re-binding, and support-driven recovery do not recreate standing access through the back door.
For practitioners
- Define passkey enrollment assurance levels Map which user populations can self-enroll, which require proofing, and which need step-up verification before a passkey is bound to the account.
- Tighten recovery and re-binding flows Review every password reset, device replacement, and help desk recovery path so it cannot silently recreate access without equivalent assurance.
- Segment passkey rollout by application risk Start with low-friction, lower-risk applications first, then require stronger policy and federation controls for sensitive workflows.
- Retire fallback factors deliberately Track which users still depend on passwords, SMS, or other fallback methods and remove them only after the passkey path is dependable.
Key takeaways
- Passkeys reduce reliance on shared secrets, but they do not remove identity governance responsibilities.
- The biggest failure point in passwordless programmes is usually recovery, not the primary sign-in flow.
- IAM teams should measure passkey success by the quality of enrollment, fallback, and lifecycle controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | SP 800-63B — Authentication | Passkeys are a digital identity authentication method and map directly to authentication guidance. |
| Recommendation — Apply SP 800-63B to assess assurance, authenticators, and recovery paths for passwordless sign-in. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Passwordless access still depends on governed authentication-to-access decisions across applications. |
| Recommendation — Use PR.AA-05 to keep authentication and authorisation decisions aligned across federated services. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Although user-facing, the article centres on how authentication strength and fallback control affect identity trust. |
| Recommendation — Review passwordless authentication flows for weak enrollment, binding, and fallback behaviours under NHI-04. | ||
| CIS Controls v8 | CIS-5 — Account Management | Passkey adoption changes account lifecycle handling, especially enrollment and deprovisioning. |
| Recommendation — Strengthen account management so passkey issuance, reset, and removal follow controlled lifecycle steps. | ||
Key terms
- Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
- Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
- Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
- Recovery Flow: The set of processes used to regain access to an account after loss of a credential or device. Recovery flows are often the weakest link in authentication because they can reintroduce shared secrets or weaker proofing, so they need the same governance discipline as primary login.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org