Topic starter
06/06/2026 2:34 am
TL;DR: Passkeys and FIDO standards are broadly understood, but RSAC 2026 conversations highlighted that deployment still breaks on enrolment, device strategy, recovery, and lifecycle management, according to OneSpan. The real problem is not whether passkeys work, but whether organisations can bind them cleanly into existing identity operations across people, devices, and sessions.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “RSAC 2026 recap: Moving passkeys from direction to execution”.
Key questions
Q: Why do passkey rollouts fail even when users understand them?
A: Passkey rollouts usually fail because the surrounding identity operations are not ready.
Q: How should teams decide between platform and hardware authenticators?
A: Teams should choose by user context, not by convenience alone.
Q: What are the biggest passkey implementation mistakes?
A: The biggest mistakes are treating passkeys as a password swap, separating recovery from assurance, and ignoring lifecycle management.
Practitioner guidance
- Map the passkey lifecycle end to end Document enrolment, recovery, device replacement, and deprovisioning as one workflow so the authentication method stays governed after first login.
- Classify users by device and assurance profile Separate shared-device users, managed-endpoint users, contractors, and higher-assurance roles before choosing platform or hardware authenticators.
- Align recovery with identity assurance Make account recovery and credential re-issuance follow the same assurance rules as enrolment, or the strongest authenticator will be bypassed through support.
Bottom line: Passkey adoption is being constrained less by understanding of FIDO and more by the operational work needed to deploy it cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:20 am
Passkey awareness is no longer the limiting factor; operational binding is. The article shows that most teams already understand the value of passwordless authentication, but execution breaks when enrolment, recovery, and device strategy are not aligned. That is an identity governance problem, not a standards problem. The practitioner lesson is to treat passkeys as a governed lifecycle, not a product choice.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How do you know if passkeys are actually improving security?
A: Look for fewer password-reset events, lower phishing exposure on supported journeys, and stable or improving completion rates for enrollment and recovery. If support tickets rise sharply or fallback use dominates, the programme may be shifting risk rather than reducing it. The best signal is improved assurance without degraded account access.
👉 Read our full editorial: Passkey execution, not awareness, is the real authentication gap