Topic starter
11/07/2026 8:26 pm
TL;DR: FIDO2 is maturing into a lifecycle governance issue, with Versasec citing almost 9-year average customer relationships and four 2025 releases tied to passkeys, smart cards, and zero-touch issuance according to Versasec. Credential administration now needs explicit ownership, logging, and decommissioning rules across enrolment, reset, and reprovisioning.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Celebrating 2025: A Year of Enterprise FIDO2 and Unprecedented Customer Loyalty”.
By the numbers:
- Versasec says its customer relationships reached an average lifetime of almost 9 years in 2025.
- Versasec released four new versions of vSEC:CMS in 2025.
- Versasec says it now serves 64 countries around the world.
Key questions
Q: Why do helpdesk reset workflows create risk for passkey programmes?
A: Because reset authority becomes part of the trust chain.
Q: What breaks when enterprises try to deploy FIDO2 without integrated lifecycle management?
A: FIDO2 deployments often stall when organisations treat enrollment as the only problem.
Q: How should security teams govern FIDO2 credentials across their lifecycle?
A: Security teams should govern FIDO2 as a full credential lifecycle, not as a one-time enrollment event.
Practitioner guidance
- Map the FIDO2 credential lifecycle Document every state change for passkeys and security keys, including enrolment, binding, reset, replacement, removal, and offboarding.
- Restrict helpdesk reset authority Limit passkey removal and reset initiation to approved roles, with clear approval and logging requirements for each action.
- Review reprovisioning workflows Test automated device transition flows to ensure old credentials are revoked and new credentials inherit the intended assurance level.
Bottom line: Enterprise FIDO2 is maturing into a lifecycle governance discipline, not just an authentication project.
Glossary terms: FIDO2 Lifecycle Management, Passkey Recovery Path, Credential Reprovisioning, Help-Desk Trust Boundary
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
11/07/2026 8:55 pm
FIDO2 maturity is now a governance problem, not an adoption problem. The article shows that enterprise organisations are moving from installing phishing-resistant authentication to managing its lifecycle as a normal identity workload. That changes the control question from "can users authenticate" to "who governs issuance, reset, and re-provisioning at scale". IAM teams should treat passkeys and security keys as governed credentials, not as a one-time rollout.
A question worth separating out:
Q: Should organisations manage passkeys and smart cards under the same governance model?
A: Yes, when both are used for phishing-resistant access and both require issuance, recovery, and removal controls. The important distinction is not the form factor but the lifecycle risk: each credential type needs consistent ownership, reset policy, and decommissioning discipline.
👉 Read our full editorial: Enterprise FIDO2 credential lifecycle management is maturing fast