Topic starter
11/07/2026 8:26 pm
TL;DR: Enterprise FIDO2 programmes are shifting from pilot deployments to lifecycle-managed credential operations, with Versasec reporting almost 9-year average customer relationships and four product releases in 2025 focused on passkeys, smart cards, and zero-touch issuance. The practical issue is no longer adoption alone but whether IAM teams can govern issuance, re-provisioning, resets, and helpdesk controls at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “Celebrating 2025: A Year of Enterprise FIDO2 and Unprecedented Customer Loyalty”.
By the numbers:
- Versasec says its customer relationships reached an average lifetime of almost 9 years in 2025.
- Versasec released four new versions of vSEC:CMS in 2025.
- Versasec says it now serves 64 countries around the world.
Key questions
Q: How should security teams govern FIDO2 credentials across their lifecycle?
A: Security teams should govern FIDO2 as a full credential lifecycle, not as a one-time enrollment event.
Q: Why do helpdesk reset workflows create risk for passkey programmes?
A: Because reset authority becomes part of the trust chain.
Q: What breaks when enterprises try to deploy FIDO2 without integrated lifecycle management?
A: FIDO2 deployments often stall when organisations treat enrollment as the only problem.
Practitioner guidance
- Map the FIDO2 credential lifecycle Document every state change for passkeys and security keys, including enrolment, binding, reset, replacement, removal, and offboarding.
- Restrict helpdesk reset authority Limit passkey removal and reset initiation to approved roles, with clear approval and logging requirements for each action.
- Review reprovisioning workflows Test automated device transition flows to ensure old credentials are revoked and new credentials inherit the intended assurance level.
Bottom line: Enterprise FIDO2 is maturing into a lifecycle governance discipline, not just an authentication project.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:55 pm
FIDO2 maturity is now a governance problem, not an adoption problem. The article shows that enterprise organisations are moving from installing phishing-resistant authentication to managing its lifecycle as a normal identity workload. That changes the control question from "can users authenticate" to "who governs issuance, reset, and re-provisioning at scale". IAM teams should treat passkeys and security keys as governed credentials, not as a one-time rollout.
A question worth separating out:
Q: Should organisations manage passkeys and smart cards under the same governance model?
A: Yes, when both are used for phishing-resistant access and both require issuance, recovery, and removal controls. The important distinction is not the form factor but the lifecycle risk: each credential type needs consistent ownership, reset policy, and decommissioning discipline.
👉 Read our full editorial: Enterprise FIDO2 credential lifecycle management is maturing fast