Notifications
Clear all
Topic starter
20/08/2026 5:34 pm
TL;DR: WebAuthn and passkeys remove shared secrets from the login path, but Ory’s guide shows the harder problems are recovery, device diversity, RP ID stability, and lifecycle handling across hybrid authentication flows. The operational shift is not just passwordless UX; it is managing identity state, fallback, and credential retirement without breaking access.
NHIMG editorial — based on content published by Ory: WebAuthn and passkeys demystified, secure passwordless login with Ory
By the numbers:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches.
- 44% of NHI tokens are exposed in the wild, being sent or stored over platforms like Teams, Jira tickets, Confluence pages, and code commits.
Questions worth separating out
Q: How should security teams adopt passkeys for infrastructure access?
A: Start with the highest-risk interactive accounts, especially administrators who are exposed to phishing and push fatigue.
Q: When do passkeys create more operational risk than they reduce?
A: They create more risk when teams deploy them before defining device loss recovery, origin stability, and cross-platform testing.
Q: What do IAM teams get wrong about passwordless authentication?
A: Teams often assume passwordless means identity has been solved, when it usually means one class of credential risk has been reduced.
Practitioner guidance
- Define recovery before rollout Map how users regain access when a device is lost, replaced, or wiped, and test that path against real support and proofing requirements.
- Stabilise relying-party and origin strategy Review domain, subdomain, and CNAME plans before enabling passkeys so existing credentials do not break when the application footprint changes.
- Run cross-platform login testing Validate passkey flows on Chrome, Firefox, Edge, Safari, iOS, Android, Windows, and macOS, including cross-device approvals and browser-specific fallbacks.
What's in the full article
Ory's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on configuring WebAuthn and passkeys in Ory Network or a self-hosted deployment.
- Implementation notes on fallback flows, recovery paths, and user onboarding for mixed authentication environments.
- Practical considerations for RP ID stability, cross-device testing, and browser-specific behaviour.
- References to Ory documentation for passkey setup and developer integration details.
👉 Read Ory's guide to WebAuthn and passkeys for passwordless login →
WebAuthn and passkeys: what identity teams must fix first?
Explore further
20/08/2026 6:20 pm
Passwordless login solves secret exposure, but not identity governance. WebAuthn removes reusable passwords from the primary authentication path, yet the control problem shifts to enrolment, recovery, and trust in the device ecosystem. That means the security gain is real, but only if the identity programme can govern the whole credential lifecycle, not just the sign-in ceremony. For practitioners, passwordless is an operating model change, not a front-end feature.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, which increases exposure paths and makes retirement harder to govern.
A question worth separating out:
Q: How do organisations know whether passkey adoption is actually reducing risk?
A: Track the share of accounts that are passkey-enrolled, the proportion of sign-ins still using passwords, and the number of recovery events that bypass the primary factor. If password use remains high or recovery is frequent, the programme is still in transition rather than truly passwordless.
👉 Read our full editorial: WebAuthn and passkeys expose the real identity lifecycle gap
