Notifications
Clear all
Topic starter
06/06/2026 1:48 am
TL;DR: Passkeys are presented as a phishing-resistant alternative to passwords and OTPs, with up to 93% login success rates versus about 63% for traditional methods, according to OneSpan. The governance question is no longer whether passkeys work, but how to introduce them alongside existing authentication without creating inconsistent assurance across users and channels.
NHIMG editorial — what this means for IAM teams
By the numbers:
- Up to 93% login success rates with passkeys vs ~63% for traditional methods.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams roll out passkeys without disrupting existing authentication flows?
A: Start with applications where phishing risk and user friction are both high, then introduce passkeys alongside current methods while you preserve enrolment, recovery, and audit continuity.
Q: When do passkeys improve security but still leave governance gaps?
A: Passkeys improve security when they replace reusable secrets, but governance gaps remain if fallback authentication, recovery, or exception handling still relies on passwords or OTPs.
Q: What do IAM teams get wrong about passkey adoption?
A: They often treat passkeys as a user-enrolment project instead of an authentication governance change.
Practitioner guidance
- Inventory legacy authentication dependencies Map which applications, user groups, and step-up flows still depend on passwords or OTPs, then identify where those methods remain the effective fallback for critical access paths.
- Segment passkey policy by assurance tier Set different registration and recovery rules for routine users, privileged users, and high-risk transactions so synced and device-bound passkeys are not treated as interchangeable.
- Redesign step-up decisions around risk Tie passkey prompts to transaction sensitivity, device posture, and sign-in context so authentication strength changes only when the access request warrants it.
What's in the full announcement
OneSpan's full guide covers the operational detail this post intentionally leaves for the source:
- A practical three-step adoption path for introducing passkeys alongside existing authentication methods
- A 5-minute self-guided demo showing enrolment, sign-in, and transaction approval flows
- Guidance on combining synced and device-bound passkeys for different assurance needs
- Implementation detail on adaptive, authenticator-aware security across cloud, on-prem, and hybrid environments
👉 Read OneSpan's guide on strengthening authentication with passkeys →
Passkeys and phishing-resistant authentication: are your controls ready?
Explore further
06/06/2026 3:07 am
Passkeys solve a human authentication problem, but they do not remove the IAM governance problem. The article is about replacing shared secrets with phishing-resistant sign-in, yet enterprises still have to govern enrolment, fallback, recovery, and assurance consistency across systems. That means the control challenge shifts from password hygiene to authentication state management. Practitioners should treat passkeys as an authentication change with lifecycle consequences, not as a drop-in fix.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- That matters because only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How do passkeys fit into step-up authentication and zero trust?
A: Passkeys fit best when step-up is driven by transaction risk, not by a one-size-fits-all login rule. In a zero-trust model, the authenticator should be selected and challenged according to context, so stronger proof is used where the access decision warrants it.
👉 Read our full editorial: Passkeys strengthen phishing-resistant authentication without passwords
