Passkeys are reaching scale faster than enterprise IAM expected

At a glance

What this is: This analysis shows that passkeys have moved into mainstream use faster than many enterprise IAM programmes expected, with adoption now driven by user experience and device readiness rather than novelty.

Why it matters: IAM teams need to treat passkeys as a rollout and governance problem, not just an authentication feature, because adoption patterns now shape conversion, support load, and policy sequencing.

By the numbers:

• Passkeys now account for 62% of all authentication challenges in a sample of one million transactions in 2025.
• Passkey autofill makes up 65% of all authentication challenges, showing that users prefer the seamless flow.
• Over 95% of iOS and Android devices are passkey-ready, removing a major deployment barrier.

Context

Passkeys are a passwordless authentication method that uses device-bound cryptographic credentials instead of shared passwords or one-time codes. In Authsignal's analysis, the main story is not technical feasibility but the speed at which users and devices have adopted passkeys across enterprise deployments.

For IAM practitioners, the governance question is now how to design passkey rollout so that adoption, support, and platform coverage move together. The article frames passkeys as a mature authentication option, which shifts the programme challenge from proving viability to controlling rollout quality and user experience.

The wider implication is that authentication modernisation is no longer blocked primarily by end-user resistance. Enterprise teams now have to reconcile faster consumer adoption, high device readiness, and multi-platform delivery with their own policy, migration, and support models.

Key questions

Q: How should teams implement passkeys in customer IAM without breaking existing sign-in journeys?

A: Start with the journeys that create the most friction, then define where passkeys are primary, where fallback is allowed, and which recovery paths remain acceptable. The goal is not to remove every alternate method immediately, but to ensure the safer path is the simplest path for most customers.

Q: Why do passkeys reduce resistance when users already trust the login flow?

A: Passkeys gain traction when they appear after a successful secure interaction, because the user has already accepted the context and can see the convenience benefit immediately. That timing matters more than abstract security messaging. In practice, the strongest adoption comes from matching the prompt to a moment when the user is already willing to continue.

Q: What signs show that a passkey programme is fragmented across channels?

A: Look for uneven enrolment between mobile and web, high fallback reliance, and support requests that cluster around recovery rather than first-time setup. Those patterns usually indicate a channel-design problem, not a passkey technology problem. When one channel is easy and another is awkward, adoption becomes inconsistent even if the underlying credential model is sound.

Q: Should organisations prioritise passkeys over OTPs and magic links?

A: Usually yes, when phishing resistance and device binding matter most. Passkeys offer stronger assurance, while OTPs and magic links can still be useful as transitional methods or lower-assurance alternatives in a phased customer IAM rollout.

Technical breakdown

Why passkey adoption is accelerating across enterprise authentication

Passkeys replace shared secrets with public-key cryptography anchored to a user device and unlocked by biometric or device authentication. That design removes password reuse and phishing risk from the primary login path, but the bigger adoption driver is usability: users can authenticate without remembering a secret, and the system can surface the passkey at the right moment. When an article shows that passkeys are reaching scale, it is usually because the combination of device support, platform integration, and familiar UX has become good enough for ordinary users, not just security-conscious early adopters.

Practical implication: Treat passkeys as a mainstream authentication pattern and design rollout around user journey fit, not pilot novelty.

Device readiness and the multi-platform passkey model

Device readiness matters because passkeys only scale when users can create, store, and present credentials across the environments they actually use. Authsignal's article highlights that iOS and Android coverage is already broad, which means the remaining challenge is consistency between mobile and web, plus whichever recovery or fallback flow an organisation keeps in reserve. Passkey programmes fail when they are designed for a single surface or assume all users will enter through the same device path. The operational issue is not just support for passkeys, but support for passkeys everywhere the identity journey exists.

Practical implication: Map passkey coverage across mobile, web, and recovery paths before expanding rollout to avoid fragmented adoption.

Why rollout timing shapes passkey conversion more than messaging alone

Passkey adoption is strongly affected by when the prompt appears in the authentication journey. Users are more likely to accept a new method after a successful secure step, such as completing another verified login, because trust is already established and the benefit is immediate. That makes passkey rollout a sequencing problem as much as a communications problem. The article also shows that clear language about convenience matters, but timing determines whether users act on that message. IAM teams should therefore think of passkey enrolment as an event-driven transition, not a static feature toggle.

Practical implication: Trigger enrolment prompts at high-trust moments and measure conversion by step in the login journey.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passkeys are no longer an emerging authentication option but a rollout governance problem. When adoption reaches mainstream levels, the question changes from whether users will accept passwordless authentication to whether IAM programmes can govern its sequencing, fallback handling, and platform coverage. That is a different operating model from classic MFA rollout. The practitioner conclusion is that passkey strategy now belongs in identity governance, not just in authentication engineering.

Authentication modernisation now depends on journey design more than feature availability. Users do not adopt passkeys because they are cryptographically elegant; they adopt them when the experience is simpler than the alternative. That means conversion is shaped by prompt timing, recovery design, and whether the flow feels native on each platform. The practical conclusion is that rollout design has become part of the control surface.

Passkey readiness exposes a new programme risk: uneven adoption across channels. A team can have strong mobile uptake while web and call centre paths lag behind, creating governance drift across the same identity population. That drift weakens policy consistency and support planning. The practitioner conclusion is to govern passkeys as a channel-spanning identity capability rather than a single login method.

Device familiarity, not user education alone, is now the adoption engine. People already understand biometrics and device unlock, so passkeys benefit from an existing trust model rather than having to create one from scratch. That changes how IAM teams should think about change management. The practitioner conclusion is to align passkey messaging with the behaviours users already perform daily.

Phased passkey rollout is becoming the default enterprise pattern because it limits support shock. The article's deployment lessons show that starting with higher-value users or high-frequency authentication journeys creates clearer feedback and faster operational learning. That matters because support volume, conversion, and recovery design all interact. The practitioner conclusion is to treat phased rollout as a governance control, not a compromise.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Passkey adoption now needs to be governed as an identity programme, not a feature release. Once users begin choosing passkeys at scale, the control question shifts to rollout consistency, fallback design, and whether every channel presents the same identity journey. Teams that do not coordinate those elements will see adoption plateau in one surface while support issues persist in another.

Passkey enrolment should be measured as a conversion path, not a binary enablement state. The critical signals are prompt timing, acceptance rate, recovery use, and help desk impact. That gives IAM teams a way to tell whether the programme is genuinely reducing friction or simply adding another authentication option.

Passwordless adoption is becoming a lifecycle issue across customer identity and workforce identity alike. As more users come to expect device-native authentication, IAM programmes will need consistent policies for enrolment, recovery, and assurance across channels. The practical result is that passkeys increasingly belong in the same governance conversation as authentication policy and identity lifecycle design.

For practitioners

• Define passkey rollout sequencing Start with user groups that authenticate frequently or handle higher-risk data, then expand only after measuring enrolment, fallback usage, and support demand. This reduces operational noise and gives IAM teams a clearer view of where the experience breaks.
• Align web and mobile coverage Validate that the same passkey journey works across browser, native app, and account recovery paths before broad rollout. Inconsistent channel support creates adoption gaps that look like user resistance but are really design gaps.
• Prompt enrolment after trust-building events Offer passkeys immediately after a successful strong-authentication event, when users are already in a security-minded flow. This is the point at which acceptance rates tend to rise and resistance falls.
• Measure support impact alongside conversion Track login completion, enrolment conversion, fallback usage, and help desk demand as a single passkey programme set. If support volume does not decline while adoption rises, the rollout may be creating hidden friction.

Key takeaways

• Passkeys have moved from experimentation into mainstream authentication, which changes the IAM problem from feasibility to rollout governance.
• The strongest adoption signals come from device readiness, familiar UX, and well-timed enrolment prompts, not from security messaging alone.
• IAM teams should govern passkeys as a channel-spanning programme, with consistent fallback, recovery, and support metrics.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Authentication Rollout Sequencing: Authentication rollout sequencing is the deliberate order in which authentication methods are introduced across user groups and systems. It matters because adoption depends on comfort, context and change management, not only on the strength of the technology being deployed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.