Topic starter
11/07/2026 8:44 pm
TL;DR: Passwords remain a liability, phishing still drives 70% of data breaches in Microsoft’s Digital Defense Report, and device-bound FIDO2 passkeys reduce credential theft by keeping the private key on hardware, according to Versasec. The governance shift is that passwordless authentication still requires issuance, revocation, reissue, and audit discipline.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Simplify FIDO2 Passkey Management with Microsoft and Versasec”.
By the numbers:
- Phishing causes 70% of data breaches, according to Microsoft’s Digital Defense Report cited by Versasec.
Key questions
Q: How should IAM teams govern passkeys across multiple platforms?
A: Treat passkeys as lifecycle-managed authenticators, not as a one-time login feature.
Q: Why do credentials create less risk than passwords but more governance work?
A: Credentials are harder to guess or reuse than passwords, so they reduce the weakness of knowledge-based authentication.
Q: What breaks when passkey recovery is not governed properly?
A: The programme falls back to the weakest legacy recovery path, which attackers often target first.
Practitioner guidance
- Define passkey lifecycle ownership Assign clear ownership for issuance, replacement, revocation, and audit of device-bound passkeys so the credential does not become an unmanaged asset.
- Pilot with privileged users first Start with administrators and other high-risk accounts where phishing resistance produces the most immediate reduction in account takeover exposure.
- Map hybrid authenticator dependencies Document which user groups, applications, and recovery paths still rely on passwords or certificates before enforcing broad passkey policy.
Bottom line: FIDO2 passkeys reduce phishing exposure by tying authentication to hardware, but they do not remove the need for identity governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:12 pm
Device-bound passkeys shift the centre of gravity from authentication strength to credential governance. The important change is not that enterprises stop managing identity assets. It is that the managed asset becomes a hardware-bound authenticator whose issuance, custody, revocation, and audit trail define control quality. Practitioners should stop thinking of passwordless as an end state and start treating it as a new governance surface.
A question worth separating out:
Q: Should organisations require passkeys for privileged accounts?
A: Yes, where account compromise would have high impact, privileged accounts should move first. That does not mean forcing every user through the same policy on day one. It means tying the strongest authentication requirement to the highest-risk identities, then supporting adoption with clear instructions and a controlled fallback strategy.
👉 Read our full editorial: FIDO2 passkey management shifts the control plane for human IAM