Passkeys are replacing passwords, but lifecycle control still matters

At a glance

What this is: This is an RSA Security analysis of why passkeys are replacing passwords and why lifecycle management still determines whether passwordless access is governable at enterprise scale.

Why it matters: IAM teams need to treat passkeys as an authentication shift with lifecycle consequences, not a simple password replacement, because recovery, device loss, and provisioning rules now carry the governance burden.

By the numbers:

• In 2026, 87% of enterprises are actively deploying or piloting passkeys.
• The average cost of a single password reset is $70 per incident.
• According to Google’s research, accounts protected by passkeys are 99.9% less likely to be compromised than password-only accounts.
• The passwordless authentication market reached $24.1 billion in 2025 and is projected to reach $55.7 billion by 2030.

Context

Passkeys are a phishing-resistant authentication method that replaces passwords with cryptographic credentials bound to a device or synced credential store. The security problem is not whether they work, but how enterprises govern enrollment, recovery, and deprovisioning without recreating the same lifecycle weaknesses that made passwords operationally painful.

RSA Security frames the transition as already underway, with enterprise adoption moving quickly and passwordless becoming a mainstream access pattern. For identity programmes, the real question is where accountability shifts when the credential is no longer remembered by the user but managed across devices, recovery workflows, and assurance levels.

That matters because passwordless changes the control surface, not just the sign-in experience. Device-bound passkeys, synced passkeys, fallback methods, and recovery paths all need different governance treatment if IAM teams want to avoid turning passwordless into another unmanaged access layer.

Key questions

Q: How should teams implement passkeys without leaving legacy recovery risk behind?

A: Treat passkeys as part of the account lifecycle, not a standalone login project. Define how users enroll, switch devices, recover access, and leave the system, then remove any fallback path that still depends on phishable methods. If recovery remains weaker than authentication, the programme still inherits password-era exposure.

Q: Why do passwordless systems still need identity governance?

A: Passwordless systems still need identity governance because authentication strength does not answer lifecycle questions. Teams still need to decide who can enrol devices, how to revoke lost authenticators, how to prove ownership during recovery, and when fallback access is acceptable. Strong login technology without governance often produces hidden exceptions that are hard to audit.

Q: What breaks when passkey recovery and fallback methods are too broad?

A: The security gain erodes when customers can bypass the passkey path through weak recovery or overused fallback channels. In that situation, the organisation has not eliminated phishing exposure, it has simply moved it to the surrounding support and exception flow.

Q: Should organisations use synced or device-bound passkeys for privileged access?

A: For privileged access, device-bound passkeys are the better default because they keep the private key on a single device and narrow the portability of the credential. Synced passkeys are more convenient, but that convenience comes with different recovery and propagation assumptions. Privileged roles need the tighter assurance boundary.

Technical breakdown

How passkeys replace passwords at the protocol layer

Passkeys use public key cryptography instead of shared secrets. A device generates a key pair during registration, keeps the private key protected locally or inside a sync fabric, and signs a challenge from the service at login. The service verifies the signature with the public key, so no reusable password is transmitted, stored, or replayed. That design removes phishing value from stolen credentials because there is nothing to harvest in transit. The security model depends on origin binding and possession of the private key, with user verification through biometrics or device PIN acting as the local unlock step.

Practical implication: treat passkeys as a control shift from secret management to credential provenance and device trust.

Synced passkeys vs device-bound passkeys

Synced passkeys trade some assurance for convenience by making the private key available across devices through a sync fabric. That is useful for consumer access and low-risk workflows, but it introduces recovery and propagation questions that matter in enterprise governance. Device-bound passkeys keep the private key on one device and are the stronger fit for privileged access, regulated systems, and high-assurance authentication. The distinction matters because the same user experience can hide very different identity assurance levels, so policy has to distinguish between portability and control.

Practical implication: define where synced passkeys are acceptable and reserve device-bound passkeys for privileged or regulated access.

Lifecycle management for passwordless access

Lifecycle control becomes the governance center once passwords disappear. The enterprise must decide how passkeys are enrolled, what happens when a device is lost, how recovery is authenticated, and how deprovisioning works when an employee leaves. Without clear lifecycle rules, passwordless access can create hidden fallback channels that undermine the very phishing resistance it was meant to deliver. In practice, the hard part is not authentication ceremony but the administrative plane behind it: enrollment, exception handling, and revocation must all be auditable and consistent.

Practical implication: govern passkey issuance, recovery, and revocation as a lifecycle process, not as a one-time login upgrade.

Breaches seen in the wild

• AnyDesk breach 2024: Attackers compromised AnyDesk's production systems; it revoked its code signing certificate and reset all portal passwords. Stolen keys were reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Passkeys move the security problem from secret protection to lifecycle governance. Once passwords are removed, the main failure mode is no longer guessing or phishing a shared secret. The governance burden shifts to enrollment, device binding, recovery, and revocation, which are identity lifecycle issues rather than authentication ceremony. That means passwordless success depends on whether the IAM programme can control the credential after issuance, not just at the moment of login.

Device-bound and synced passkeys are not interchangeable controls. Synced passkeys optimise convenience and portability, while device-bound passkeys optimise assurance and containment. Treating them as one category collapses a key governance distinction, because the attack surface, recovery model, and acceptable use cases are different. Practitioners need policy that explicitly separates assurance tiers instead of assuming every passkey provides the same enterprise control.

Passkeys are replacing passwords, but passwordless does not eliminate fallback risk. Any environment that keeps legacy OTP, push approval, or help-desk recovery as a routine fallback can reintroduce the very phishable paths passkeys were meant to remove. The enterprise question is whether the fallback path is governed as an exception or allowed to become the real control. That determines whether passwordless reduces attack surface or simply moves it.

Passkey adoption is a strong signal that identity teams are finally treating phishing resistance as baseline authentication design. The market has moved beyond proving that passwords are weak. The next differentiator is whether organisations can operate passwordless access with clear governance over device loss, recovery, and privileged use. IAM programmes that separate assurance level from convenience will be better positioned to absorb this shift without operational drift.

Passwordless is becoming a governance programme, not just an authentication upgrade. The stronger the deployment, the more important it becomes to define ownership across IAM, help desk, endpoint management, and privileged access teams. Organisations that do not assign these lifecycle responsibilities will end up with fragmented recovery paths and inconsistent assurance. The practitioner conclusion is straightforward: passwordless succeeds only when the operating model changes with it.

From our research library:

• Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.

What this signals

Passwordless changes the governance centre of gravity. Once the password disappears, the control problem moves to device binding, recovery authority, and revocation discipline. Teams that keep treating passkeys as a front-end authentication swap will miss the operational changes required in IAM, help desk, and privileged access.

Passkey rollout exposes where identity programmes still depend on legacy fallback. If the organisation keeps OTP, push prompts, or manual resets as routine paths, passwordless will not eliminate phishable access. The governance test is whether those fallback methods are controlled as exceptions or quietly remain the default route.

Credential lifecycle becomes the differentiator in passwordless maturity. The strongest programmes will separate assurance tiers, route privileged users to device-bound passkeys, and make recovery auditable. That aligns passwordless with modern IAM operating models rather than letting it become another convenience layer.

For practitioners

• Define passkey assurance tiers Set policy that distinguishes synced passkeys from device-bound passkeys, and reserve the highest-assurance option for privileged and regulated access paths.
• Map recovery and loss workflows Document what happens when a device is lost, stolen, or replaced, including who can approve recovery and which evidence is required before re-enrolment.
• Retire phishable fallback paths Reduce routine dependence on OTP, push approval, and help-desk reset flows so passwordless deployment does not preserve a weaker alternate route.
• Pilot with privileged users first Start with IT administrators or a tightly scoped business unit, then measure successful sign-ins, fallback use, and help desk volume before broad rollout.
• Integrate passkeys into IAM lifecycle Tie enrollment, deprovisioning, and exception handling into the same identity governance process used for joiner, mover, and leaver events.

Key takeaways

• Passkeys reduce credential theft risk, but they do not remove the need to govern how access is enrolled, recovered, and revoked.
• The most important distinction for practitioners is between synced passkeys and device-bound passkeys, because the assurance model is not the same.
• Passwordless succeeds when IAM, help desk, and privileged access teams share a lifecycle model for the credential, not when login is merely made easier.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Device-Bound Passkey: A device-bound passkey is a FIDO credential tied to one physical device and generally stored in hardware-backed secure components. The value for enterprise security is lifecycle control, because the credential is easier to inventory, constrain, and revoke without relying on cloud sync paths.
• Synced Passkey: A synced passkey is a FIDO credential that can be replicated across multiple devices through a cloud account and recovery system. It can improve usability, but it also shifts trust from a single device to the sync provider, recovery workflow, and account protections surrounding the credential.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.