Passkeys, phishing resistance, and authentication trends in 2025

At a glance

What this is: This is Yubico’s 2025 authentication trends post, centred on survey findings, passkey usability, device-bound deployment, and the practical push toward phishing-resistant access.

Why it matters: It matters because IAM teams must decide how to scale phishing-resistant authentication without creating usability gaps, rollout friction, or uneven coverage across user populations.

By the numbers:

• Yubico’s 2025 Global State of Authentication survey draws on responses from 18,000 employed adults around the world.

Context

Passkeys are a phishing-resistant authentication method that replaces reusable passwords with cryptographic credentials bound to a user device or platform. In this article, Yubico ties that shift to a broader 2025 authentication trend: AI-driven phishing is still evolving, so identity teams are being pushed to make passwordless access usable as well as secure.

The governance issue is not simply adoption. Enterprises need authentication methods that can be deployed at scale, work across user populations, and fit regulatory and operational constraints without creating exceptions that reintroduce weak fallback paths.

Key questions

Q: What breaks when passkeys are used alongside weak fallback authentication?

A: The programme becomes only as strong as the fallback path. If password resets, backup codes, or help desk overrides are easier to abuse than the passkey flow, attackers will target those routes instead. Passwordless adoption fails when exception handling is less governed than primary authentication.

Q: Why do passkey rollouts stall after the first adoption wave?

A: They stall when users see failed passkey attempts, stale credentials or awkward recovery flows. Each of those moments teaches users that the new method is unreliable, so they return to passwords and stop trying the passkey path unless the configuration is tightened.

Q: How can organisations tell whether authentication is actually phishing-resistant?

A: Authentication is phishing-resistant when a stolen code, password, or proxy cannot be reused to satisfy the login flow. The control should bind the credential to the device or verifier, remove shared secrets from the critical path, and avoid fallback steps that reintroduce phishable factors.

Q: Should teams prioritise passkeys over other IAM improvements?

A: Only when the organisation has already addressed recovery, device trust, and lifecycle governance. Passkeys can remove a major phishing and password-reuse problem, but they do not fix identity proofing gaps, poor offboarding, or weak account recovery. The right sequence is to align passkeys with the controls that determine whether authentication remains trustworthy over time.

Technical breakdown

Device-bound passkeys and phishing resistance

Device-bound passkeys use public-key cryptography so the private key stays on the user’s device while the server stores only the public key. That design reduces replay risk because a phisher cannot reuse the credential after capture, and it changes the attacker’s target from password theft to device compromise or session interception. In practice, the security value depends on whether the passkey is truly bound to the device rather than exported or mirrored across uncontrolled endpoints. This makes authentication architecture and endpoint trust part of the same control surface.

Practical implication: inventory which users are still protected by reusable fallback factors and phase them out where passkeys are deployed.

PIN enhancements and passkey usability at scale

Passkey programmes fail when users cannot complete enrolment, recovery, or everyday authentication without friction. PIN improvements matter because local unlock factors determine whether the passkey remains practical for high-assurance use cases, especially in enterprise environments where help desk recovery and hardware token usage are common. The architectural issue is not just cryptographic strength, but whether the authentication path stays accessible enough that users do not bypass it. Good passkey design therefore sits at the intersection of security, user experience, and account recovery governance.

Practical implication: test enrolment and recovery paths before broad rollout, because weak usability drives shadow fallback behaviour.

Expanded delivery options and governance for distributed deployment

When device-bound passkeys are deployed across many regions and form factors, the challenge becomes governance rather than availability. Delivery models, regional fulfilment, and enterprise provisioning affect who can get a secure credential, how quickly replacements arrive, and whether policy can be enforced consistently across the user base. That is especially important when the organisation wants a phishing-resistant posture without creating privileged exceptions for some teams or geographies. The control problem is lifecycle management, not just issuance.

Practical implication: align passkey provisioning, replacement, and support processes with identity lifecycle controls so deployment scale does not weaken assurance.

Threat narrative

Attacker objective: The attacker wants to bypass authentication by stealing or replaying credentials, then use the resulting access to take over accounts or impersonate users.

1. Entry occurs when phishing campaigns reach users through increasingly varied channels and attempt to capture reusable authentication factors or redirect sessions.
2. Credential access is limited when the target uses device-bound passkeys, because the attacker cannot harvest a reusable secret from a successful login prompt.
3. Impact shifts from password compromise to endpoint compromise or exception abuse, which means control failure now concentrates in recovery, fallback, and device trust paths.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing resistance is now a deployment problem, not an authentication concept problem. The market has moved past the question of whether passkeys are stronger than passwords. The harder issue is whether organisations can deploy them consistently enough that users do not fall back to weaker factors, unmanaged recovery flows, or exception handling. For IAM teams, the control objective has shifted from credential strength alone to control coverage across the full authentication path.

Passkey usability is an adoption control. If enrolment, recovery, and device replacement are painful, users route around the control and recreate the very risk the programme was meant to remove. That means authentication assurance depends on help desk design, endpoint readiness, and policy clarity as much as on cryptography. Practitioners should treat usability as part of the security control itself.

Device-bound credentials narrow the phishing window but widen the governance surface. Once the secret is tied to a device, the main risk moves to lifecycle events such as lost hardware, replacement logistics, and regional distribution. That is a stronger security position, but only if the organisation can govern issuance and recovery without reintroducing shared secrets or inconsistent exceptions. The result is a more disciplined identity lifecycle, not a simpler one.

Phishing-resistant authentication is becoming a baseline expectation across human IAM, while also shaping NHI and agentic controls. The same governance instinct applies across the identity spectrum: remove reusable secrets, reduce replay value, and tighten recovery. Human authentication programmes lead that change, but the organisational lesson extends to machine and agent identities that still rely on static credentials. Identity security is converging on proof of possession and lifecycle control.

Passkey scale will expose policy fragmentation quickly. When enterprises expand adoption across regions, devices, and user groups, hidden inconsistencies in provisioning and support become visible. That is where identity maturity is really measured: whether the control can survive operational variance without fragmenting into multiple assurance levels. Practitioners should expect passkey rollouts to reveal weak spots in access governance, not just authentication technology.

What this signals

Passkey programmes expose the real state of authentication governance. Once reusable factors start disappearing, the remaining gaps are easier to see: weak recovery, inconsistent support workflows, and uneven policy enforcement across regions. That makes passkey deployment a maturity test for the whole identity programme, not just the sign-in page.

Identity teams should expect phishing pressure to shift rather than disappear. As passwordless access becomes more common, attackers will focus on onboarding, help desk manipulation, device trust, and fallback abuse. The operational question is whether the organisation has governed those paths before the attack adapts.

Phishing-resistant access only scales when lifecycle controls scale with it. Provisioning, replacement, and revocation have to keep pace with user movement and device turnover or the programme will fragment into exceptions. In practice, that means passkeys need the same governance discipline as any other enterprise access control.

For practitioners

• Map fallback authentication paths Identify where passwords, SMS, or other reusable factors still remain after passkey rollout and remove them where policy allows.
• Test passkey enrolment and recovery Validate what users experience during first use, lost-device recovery, and help desk-assisted reset so the control remains usable under real conditions.
• Standardise device replacement workflows Define how new hardware, shipping delays, and regional support affect credential replacement so users do not revert to weaker temporary access.
• Tie authentication policy to lifecycle governance Align issuance, replacement, and revocation with joiner-mover-leaver processes so passkeys remain governed across the credential lifecycle.

Key takeaways

• Passkeys reduce replayable credential risk, but they do not eliminate phishing pressure or the need for governed fallback paths.
• The main adoption bottleneck is operational, because usability, recovery, and device handling determine whether users stay on the stronger control.
• Authentication maturity now depends on whether identity teams can scale phishing resistance without creating unmanaged exceptions or weak recovery flows.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Device-bound Credential: A device-bound credential is a key or token that can only be used from an approved device or authenticator. In practice, it reduces replay and theft risk, but it also raises the stakes of enrollment, attestation, and revocation because the credential can act repeatedly until invalidated.
• Fallback authentication: Fallback authentication is the secondary method used when the primary sign-in factor is unavailable. For passkey deployments, fallback must be tightly governed because it often becomes the attacker’s preferred route if it remains easier to abuse than the main login path.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.