Passkeys replace passwords, but the governance gap remains

At a glance

What this is: This is an explanatory piece on passkeys versus passwords that argues the technical win is real, but the governance model for mixed authentication is still catching up.

Why it matters: IAM and identity leaders need to treat passwordless adoption as a control transition, not just an authentication upgrade, because fallback methods and rollout sequencing change risk ownership.

By the numbers:

• Passkeys used in 62% of authentication flows in Authsignal's analysis of one million authentication attempts.
• Google's early trials measured passkey logins averaging 14.9 seconds versus 30.4 seconds for passwords.
• A 2025 FIDO Alliance study found 54% of users consider passkeys more convenient and 53% say they feel more secure than passwords.

Context

Passkeys change the authentication problem by replacing a memorized secret with device-bound cryptography and a local user check. The security gain is clear, but the governance gap appears when organisations keep passwords, recovery paths, and legacy exceptions alive alongside passkeys.

That mixed estate matters for identity governance because the control surface no longer sits only in password policy, reset flows, or phishing resistance. Teams now have to govern enrolment, fallback, device trust, and authentication coverage as part of one transition, not as separate tickets.

For IAM leaders, the question is not whether passkeys are technically stronger than passwords. The real issue is whether current authentication governance can handle a period where both methods coexist and where the weaker path often survives for compatibility reasons.

Key questions

Q: How should organisations roll out passkeys without breaking existing login flows?

A: Start with the highest-friction, highest-support-cost applications, then phase in passkeys alongside a measured fallback strategy. Preserve user access during migration, but define exit criteria for password-based sign-in so fallback does not become permanent. The real success factor is not launch speed. It is whether the new login path works across recovery, device change, and legacy application constraints.

Q: Why do passkeys reduce phishing risk compared with passwords?

A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret. That means a fake site cannot harvest a password and replay it later. The phishing benefit is real, but it only holds if the organisation also limits weak fallback methods that attackers can abuse instead.

Q: What breaks when passwordless access is added without governance changes?

A: The main failure is that organisations replace one authentication step but leave the same access model in place. Shared accounts, overprovisioned rights, and long sessions still create attribution gaps and excess exposure, so the programme looks modern while the control weaknesses remain intact.

Q: When should identity teams prioritize passkeys over password resets and SMS MFA?

A: When the organisation is ready to govern the full lifecycle, including enrollment, loss recovery, and fallback removal. Passkeys improve resistance to phishing and replay, but they only reduce risk if the surrounding identity processes do not reintroduce weaker access paths.

Technical breakdown

How passkey authentication works

A passkey uses public key cryptography instead of a shared secret. The user’s device creates a private key that stays local and a public key stored by the service. During login, the service issues a challenge and the device signs it with the private key after a local biometric check or device unlock. The server verifies the signature with the public key, which means there is no password to type, steal, reuse, or spray. This changes the attack surface from secret management to device and enrolment trust.

Practical implication: shift authentication controls from password policy to device trust, enrolment assurance, and recovery governance.

Why passwords keep failing in practice

Passwords remain easy to deploy because every system supports them, but that ubiquity creates structural weakness. Users reuse them, forget them, reset them, and hand them over in phishing or social engineering flows. Even strong passwords can be captured in breaches or guessed at scale, and once a shared secret exists, the organisation must protect it everywhere it travels. The issue is not only user error. It is that password governance depends on secrecy, memorability, and stable reuse, three conditions that modern attack and user behaviour routinely break.

Practical implication: treat password dependence as a standing exposure path, especially where reset and recovery workflows remain broad.

Passkeys in a mixed authentication estate

The operational reality is coexistence. Many organisations will run passkeys alongside passwords, MFA, and fallback recovery methods for a long period. That creates policy complexity because the strongest login path does not automatically eliminate weaker paths. If password fallback stays enabled too widely, the organisation still carries phishing and credential theft risk through the back door. Governance therefore has to track which users, applications, and recovery flows still depend on passwords, and which ones have actually moved to passwordless operation.

Practical implication: inventory fallback authentication paths and treat them as first-class governance objects, not temporary exceptions.

NHI Mgmt Group analysis

Passkeys expose an authentication governance gap, not just a better login method. The article is about password replacement, but the deeper issue is that identity programmes usually govern the secret, not the whole authentication journey. Once the password disappears, teams still have to govern recovery, fallback, device trust, and coverage across applications. The implication is that passwordless adoption is an identity governance programme, not an authentication feature rollout.

Mixed authentication estates are now the real control boundary. Organisations rarely switch every application and user at once, so passwords persist in exception paths long after passkey rollout starts. That means risk migrates from the primary login ceremony to the weakest residual path. Teams need to recognise that partial adoption can improve the front door while leaving the side door open.

Passkey adoption shifts the centre of gravity from memorised secrets to enrolment assurance. When the secret is removed from the user, governance moves to who can enrol devices, what recovery methods are allowed, and how strong the binding is between user, device, and account. That makes lifecycle control more important than password complexity ever was. Practitioners should treat passkey enrolment as an access control event, not a convenience setting.

Passwordless migration is now a control-mapping exercise across human IAM and adjacent NHI patterns. The same governance instinct that protects human sign-in flows also applies to any system that depends on recovery tokens, shared secrets, or fallback credentials. What changes is the security logic: once the strongest path becomes device-bound, the residual secret paths become the dominant risk. Identity teams should re-map controls around fallback, not around the password itself.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Password-related issues can represent 10–50% of service desk calls, many of which are avoidable.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Passkey adoption will expose weak fallback governance. As organisations move away from passwords, the main failure mode shifts from password strength to the controls around enrolment, recovery, and exception handling. Teams that keep broad fallback paths will preserve the same impersonation risk under a different login method.

Passkeys used in 62% of authentication flows according to the State of Secrets Sprawl 2026, which suggests the authentication market is already normalising mixed estates rather than clean replacements. Identity leaders should plan for coexistence and governance visibility, not assume a single cutover date.

Passkey governance will increasingly look like lifecycle governance. The important decisions move to who can enrol, when re-enrolment is allowed, and how quickly exceptions are retired. That is an access governance problem as much as an authentication design problem.

For practitioners

• Map all fallback authentication paths Inventory where passwords still exist as primary login, backup login, recovery, or exception handling. Rank those paths by user volume and business criticality, then decide which ones can be removed, tightened, or constrained to lower-risk populations.
• Treat passkey enrolment as a governed lifecycle event Define who can enrol a device, how the binding is verified, what proof is required at enrolment, and how re-enrolment happens after device loss or compromise. If enrolment is casual, the control becomes easy to bypass.
• Reduce password fallback scope Limit password use to applications or user groups that genuinely need it, then progressively retire it where passkeys are available. Keep a tight exception register so the remaining password paths are visible and reviewable.
• Align identity helpdesk and recovery flows Update reset, recovery, and account takeover workflows so they do not recreate the same phishing and credential theft exposure that passkeys are supposed to remove. Recovery should be stricter than the everyday login path, not weaker.

Key takeaways

• Passkeys improve authentication by removing shared secrets from the primary login flow, but the remaining risk concentrates in recovery and fallback paths.
• The article's evidence points to real usability and adoption gains, including faster logins and higher success rates, but those gains do not automatically equal clean governance.
• Identity teams should treat passkey rollout as a control redesign exercise, with special attention to enrolment, exception handling, and password retirement.

Key terms

• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Alternate Authentication Path: An alternate authentication path is any credential or trust relationship that can be used after the primary token is removed. Security teams miss these paths when they treat revocation as the end of the incident instead of checking for newly planted keys, app grants, or delegated sessions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.