Notifications
Clear all
Topic starter
11/07/2026 8:26 pm
TL;DR: Enterprise FIDO2 programmes are shifting from pilot deployments to lifecycle-managed credential operations, with Versasec reporting almost 9-year average customer relationships and four product releases in 2025 focused on passkeys, smart cards, and zero-touch issuance. The practical issue is no longer adoption alone but whether IAM teams can govern issuance, re-provisioning, resets, and helpdesk controls at scale.
NHIMG editorial — based on content published by Versasec: Celebrating 2025, a year of enterprise FIDO2 and customer loyalty
By the numbers:
- Versasec reports customer relationships reached an average lifetime of almost 9 years in 2025.
- Versasec says it entered 3 new international markets and now serves 64 countries worldwide.
Questions worth separating out
Q: How should security teams govern FIDO2 credentials across their lifecycle?
A: Security teams should govern FIDO2 as a full credential lifecycle, not as a one-time enrollment event.
Q: Why do enterprise FIDO2 rollouts often stall in production?
A: They usually stall because the security model is stronger than the operating model.
Q: What breaks when helpdesk staff can reset passkeys without oversight?
A: The trust boundary breaks.
Practitioner guidance
- Map every FIDO2 credential state transition Document enrollment, re-provisioning, reset, removal, and offboarding as explicit lifecycle states with named owners and approval points.
- Separate helpdesk resets from routine administration Classify passkey removal and FIDO reset requests as privileged actions, require logging and review, and limit who can execute them.
- Test converged issuance for shared failure points Review workflows that combine FIDO2, PKI, and physical access issuance for common breakpoints in identity proofing, hardware assignment, and recovery.
What's in the full article
Versasec's full article covers the operational detail this post intentionally leaves for the source:
- Release-by-release product changes across vSEC:CMS 7.0, 7.1, 7.2, and 7.2.2.
- Specific FIDO management workflows for multiple passkey enrollment and automated re-provisioning.
- Expanded hardware support and zero-touch credential shipping details for enterprise rollout teams.
- Partnership and market expansion milestones that frame the product update in a broader commercial context.
👉 Read Versasec's 2025 update on enterprise FIDO2 credential lifecycle management →
FIDO2 lifecycle management: what it means for IAM teams?
Explore further
11/07/2026 8:55 pm
Enterprise FIDO2 is becoming an identity lifecycle discipline, not an authentication feature. The 2025 release pattern shows that value now sits in enrollment, transition, recovery, and ongoing management rather than in the authenticator alone. That is a signal to IAM teams that phishing resistance cannot be operationalised without lifecycle governance, inventory, and administrative accountability. Practitioners should judge FIDO2 programmes by lifecycle control maturity, not by token adoption rates.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to the 2024 Non-Human Identity Security Report.
- 59.8% of organisations see value in a solution that simplifies non-human access management and introduces dynamic ephemeral credentials.
A question worth separating out:
Q: Should organisations treat FIDO2 as part of privileged access governance?
A: Yes, when the organisation allows staff to remove credentials, initiate resets, or transition authenticators between systems. Those actions can alter the authentication state of the identity and should be governed like privileged access. The practical test is whether the same oversight would apply if an admin changed any other high-trust control.
👉 Read our full editorial: Enterprise FIDO2 credential lifecycle management is maturing fast
