Passkeys and passwords: what changes for enterprise identity security

At a glance

What this is: This article compares passwords and passkeys for enterprise identity security and argues that the main issue is not credential preference, but how authentication fits broader identity operations and compliance.

Why it matters: It matters because IAM teams need to decide where passkeys improve assurance, where passwords still persist, and how to avoid creating migration gaps across human and non-human access paths.

Context

Passkeys and passwords solve the same entry problem in very different ways. Passwords are shared-secret credentials that users can reuse, forget, phish, or weaken through predictable behavior, while passkeys use public-key cryptography so the private key stays on the device.

For identity programmes, the important question is not whether passkeys are safer in isolation. It is how authentication choices interact with lifecycle management, federation, certificate-based trust, auditability, and regulated access controls across business applications and delegated access models.

Key questions

Q: How should organisations decide whether to prioritise passkeys over passwords?

A: Organisations should prioritise passkeys when they want stronger authentication with less user friction and a cleaner path toward passwordless access. Passkeys use device based proof of identity instead of shared secrets, which reduces reliance on passwords and can improve privacy. The decision depends on how well teams can integrate them into existing authentication flows.

Q: How do passkeys affect identity governance and lifecycle controls?

A: Passkeys shift governance from password policy toward device enrolment, recovery, revocation, and auditability. Identity teams need to track how a passkey is issued, how it is bound to a device, what happens when a device is lost, and how access is removed across linked services. That is a lifecycle problem, not only a login problem.

Q: What are the signs that password-based authentication is becoming unsustainable?

A: Warning signs include frequent resets, heavy help desk burden, widespread password reuse, weak password hygiene, and repeated phishing exposure. If users are spending too much time managing credentials, or if security teams still see successful password attacks despite policy enforcement, the authentication model is no longer keeping pace with the threat environment.

Q: What should teams do when passkeys are not supported everywhere yet?

A: Use a hybrid model and separate the systems that can absorb passkeys from the ones that still require passwords or other federated methods. Keep the migration scoped to the applications, user groups, and recovery workflows you can govern end to end, and avoid a broad rollout that leaves support and compliance gaps.

Technical breakdown

Why passwords remain a durable attack surface

Passwords are still vulnerable because they depend on human memory, reuse, and server-side verification. That makes them exposed to phishing, brute force, credential stuffing, and weak reset practices. Even when password managers exist, the control still depends on users, support workflows, and policy enforcement across every application that accepts the secret. The security problem is not just cracking strength. It is the operational inconsistency that appears when thousands of accounts rely on a shared, user-generated secret model. Practical implication: treat password risk as a system-wide authentication design issue, not just a user hygiene problem.

Practical implication: Prioritise controls that reduce reusable secret exposure and reset dependency across the authentication estate.

How passkeys change authentication mechanics

Passkeys use a key pair rather than a memorised secret. The public key is registered with the service, while the private key remains on the user device and proves possession without being transmitted over the network. Authentication is typically paired with device PIN or biometrics, which shifts verification from what the user knows to what the device holds and what the local authenticator confirms. Because the private key is not sent to the relying party, phishing sites have little to intercept. Practical implication: passkeys improve resistance to credential theft, but they also create device and lifecycle dependencies that need governance.

Practical implication: Map passkey enrolment, recovery, and device loss workflows before broad rollout.

Where PKI and federation complicate rollout

Passkeys do not exist outside the wider identity stack. The article ties them to PKI, SAML, OAuth 2.0, OIDC, SSO, certificate-based authentication, and lifecycle operations such as provisioning, rotation, revocation, and audit trails. That means organisations are not choosing a login method alone. They are choosing how trust is established, how identities federate across applications, and how credentials are managed when devices change or access is removed. Practical implication: the technical question is whether the organisation can govern authentication as part of the full identity lifecycle, not just at sign-in.

Practical implication: Align passkey adoption with federation, certificate, and offboarding processes before changing user sign-in standards.

Threat narrative

Attacker objective: The attacker aims to obtain authenticated access that can be reused across connected systems and applications.

1. Entry begins with a user-authored password that can be phished, reused, or brute-forced across services.
2. Credential access follows when attackers capture the secret through phishing, credential stuffing, or weak password patterns.
3. Escalation occurs when one compromised login unlocks connected applications, SSO paths, or linked systems.
4. Impact is broad account takeover, because the same compromised authentication pattern can expose multiple business services.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Reusable secret authentication is the real governance debt: Passwords fail not only because they are weak, but because they embed a reusable-secret model into every downstream control. That model encourages reuse, reset workflows, and support overhead that scale badly in large enterprises. Identity programmes that keep treating password risk as a user habit problem miss the architectural issue. The practical conclusion is that authentication design, not user discipline, is the control boundary that matters.

Passkeys shift the security boundary from memory to device possession: The security property changes when the private key never leaves the device and cannot be replayed on a fake site. That weakens phishing as an identity theft path, but it does not remove governance requirements around enrolment, recovery, and lost-device handling. The implication for practitioners is that passkey adoption is a control redesign exercise, not a cosmetic credential replacement.

Authentication choice now sits inside lifecycle governance, not beside it: The article correctly links passkeys to provisioning, revocation, audit trails, PKI, and federation. That is where identity programmes often underinvest, because the login method is visible while the surrounding lifecycle is treated as plumbing. Mature identity governance has to cover how credentials are issued, bound, recovered, and removed across both human and delegated access paths. The practical conclusion is to govern authentication as a lifecycle capability, not an isolated sign-in project.

Passkeys expose the limits of password-era compliance assumptions: Compliance frameworks that assume periodic password change, manual reset, and static authentication state become less informative when the primary control shifts to cryptographic possession. That does not remove auditability, but it changes what evidence matters. For practitioners, the challenge is to prove authentication assurance through device, federation, and recovery governance rather than through password policy alone.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Passkey adoption is an authentication redesign project, not a login swap: The operational work sits in enrolment, device binding, recovery, and offboarding. Teams that treat passkeys as a front-end replacement will miss the governance dependencies that determine whether the control actually reduces risk.

Authentication evidence will need to evolve with the control model: Password-era metrics such as reset volume remain useful, but they are no longer enough to judge assurance. Identity programmes should shift attention toward proof of device possession, recovery integrity, and revocation completeness.

Passkeys strengthen phishing resistance, but only inside a broader identity architecture: Federation, SSO, PKI, and lifecycle governance still determine whether the authentication flow can be operated safely at scale. The programme implication is to align sign-in modernisation with the rest of the identity stack, not run it as a standalone initiative.

For practitioners

• Inventory authentication dependencies by application Map where passwords, passkeys, SSO, federation, and certificate-based authentication are actually used so migration decisions reflect real control paths, not user preference alone.
• Define passkey recovery and device-loss procedures Specify how new devices are enrolled, how lost devices are handled, and how revoked access is removed from linked applications and sessions.
• Rework audit evidence for cryptographic sign-in Update logging and review processes so authentication evidence focuses on enrolment, device binding, and revocation events rather than password change cadence.
• Segment rollout by risk and user population Start with applications and user groups where phishing resistance matters most, then expand based on support capacity, compliance requirements, and recovery maturity.

Key takeaways

• Passwords remain a structural liability because they depend on reusable secrets, human behavior, and support-heavy recovery workflows.
• Passkeys materially improve phishing resistance by keeping the private key on the device and proving possession without transmitting the secret.
• The real enterprise decision is how authentication fits lifecycle governance, federation, and audit evidence across the identity stack.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Public Key Infrastructure: Public Key Infrastructure is the trust system that issues, manages, and revokes digital certificates used to prove identity. In practice it binds keys to entities and policies, making authentication, encryption, and non-repudiation possible across users, devices, and services.
• Federated Authentication: Federated authentication lets one organisation or platform accept a login performed by another trusted identity system. The application no longer verifies the user directly. Instead, it consumes signed claims or assertions, which makes trust relationships, certificates, and attribute mapping part of the security boundary.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.