Topic starter
25/06/2026 12:57 am
TL;DR: Passkeys replace passwords with cryptographic authentication tied to a user’s device and are positioned by Cerby for shared-app access, admin visibility, and reduced password overhead, according to Cerby and the FIDO Alliance. Passwordless controls improve sign-in security, but they also force IAM teams to rethink how shared accounts, revocation, and access logging are governed.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Passkeys in Cerby: Faster, Safer, Passwordless Login”.
Key questions
Q: What breaks when shared accounts move to passkeys without lifecycle controls?
A: The biggest failure is false confidence.
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: How do teams know if passwordless shared access is actually governed?
A: Look for evidence that shared accounts have named owners, enrolment records, audit logs, and a removal process when access is no longer needed.
Practitioner guidance
- Map shared accounts to explicit owners Record who is accountable for each shared application account before moving it to passkeys, and require an owner for enrolment, logging review, and revocation decisions.
- Align passkey enrolment with offboarding workflows Treat passkey removal as part of leaver handling so that access is revoked when a user leaves a team, vendor relationship, or support function.
- Preserve auditability across shared-app sign-ins Make sure each passkey-enabled shared account produces logs that identify the enrolling user, the device, and the access event for later review.
Bottom line: Passkeys improve shared-app authentication by replacing reusable passwords with device-bound cryptographic sign-in.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:04 am
Passkeys improve authentication strength, but they do not solve shared-account governance. The control change is real, because phishing-resistant sign-in is stronger than password reuse. But the ownership problem remains, and shared access still needs enrolment, review, and revocation discipline. Practitioners should not confuse stronger login with complete governance.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should IAM teams handle shared passwords and shared credentials?
A: IAM teams should treat shared passwords as a control exception that increases risk and weakens accountability. If shared access is unavoidable, it needs a documented owner, tight privilege boundaries, frequent review, and a clear plan to eliminate it. The safer default is to move to individual accountability or privileged session controls.
👉 Read our full editorial: Passkeys in Cerby shift shared-app access toward phishing resistance