Topic starter
25/06/2026 12:57 am
TL;DR: Passkeys replace passwords with device-bound cryptographic sign-in for shared-app access, according to Cerby. Shared accounts still need clear ownership, revocation, and audit logs or passwordless login can outpace governance.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Passkeys in Cerby: Faster, Safer, Passwordless Login”.
Key questions
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: How do teams know if passwordless shared access is actually governed?
A: Look for evidence that shared accounts have named owners, enrolment records, audit logs, and a removal process when access is no longer needed.
Q: What breaks when shared accounts move to passkeys without lifecycle controls?
A: The biggest failure is false confidence.
Practitioner guidance
- Map shared accounts to explicit owners Record who is accountable for each shared application account before moving it to passkeys, and require an owner for enrolment, logging review, and revocation decisions.
- Align passkey enrolment with offboarding workflows Treat passkey removal as part of leaver handling so that access is revoked when a user leaves a team, vendor relationship, or support function.
- Preserve auditability across shared-app sign-ins Make sure each passkey-enabled shared account produces logs that identify the enrolling user, the device, and the access event for later review.
Bottom line: Passkeys improve shared-app authentication by replacing reusable passwords with device-bound cryptographic sign-in.
Glossary terms: Passkey, Shared Account, Phishing-Resistant Authentication, Authenticator Lifecycle Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:04 am
Passkeys improve authentication strength, but they do not solve shared-account governance. The control change is real, because phishing-resistant sign-in is stronger than password reuse. But the ownership problem remains, and shared access still needs enrolment, review, and revocation discipline. Practitioners should not confuse stronger login with complete governance.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should IAM teams handle shared passwords and shared credentials?
A: IAM teams should treat shared passwords as a control exception that increases risk and weakens accountability. If shared access is unavoidable, it needs a documented owner, tight privilege boundaries, frequent review, and a clear plan to eliminate it. The safer default is to move to individual accountability or privileged session controls.
👉 Read our full editorial: Passkeys make shared-app access more phishing-resistant, but governance must catch up
This post was modified 1 day ago by NHI Mgmt Group