Notifications
Clear all
Topic starter
01/08/2026 8:55 pm
TL;DR: FIDO2 passkeys reduce phishing and password risk, but enterprise environments still face gaps in device visibility, revocation, and session-layer attacks after login, according to Gradient Technologies. Consumer-grade authentication stops at sign-in, while corporate identity programmes need continuous trust validation across the session.
NHIMG editorial — based on content published by Gradient Technologies: Why FIDO2 Products Alone Don’t Solve Corporate Authentication
Questions worth separating out
Q: How should security teams adopt passkeys for infrastructure access?
A: Start with the highest-risk interactive accounts, especially administrators who are exposed to phishing and push fatigue.
Q: Why do FIDO2 deployments still leave organisations exposed after login?
A: Because FIDO2 primarily protects the authentication event, not the full session lifecycle.
Q: What do IAM teams get wrong about consumer passkeys in the workplace?
A: They often import a consumer trust model into an enterprise environment that needs central control.
Practitioner guidance
- Map the authentication boundary to the session boundary Document where your current passkey or FIDO2 deployment stops protecting access, then identify the downstream controls that must take over for token abuse, replay, and consent-based attacks.
- Unify device trust and revocation workflows Require a single operational path for enrolment, compliance enforcement, and credential revocation so that terminated users or compromised devices do not persist across separate management consoles.
- Add runtime checks before session renewal Use continuous attestation or an equivalent trust revalidation step before renewal of short-lived sessions, especially where unmanaged devices or hybrid access paths exist.
What's in the full article
Gradient Technologies' full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor layers MDM and IdP policy around FIDO2 to recover enterprise control across device types
- The specific mechanics of continuous remote attestation before session renewal and how it blocks replay
- How short-lived hardware-bound X.509 certificates are provisioned, rotated, and revoked in the product flow
- Operational examples of one-time enrollment, zero-friction login, and reduced helpdesk load in hybrid environments
FIDO2 passkeys and enterprise auth: are your controls enough?
Explore further
01/08/2026 9:03 pm
Authentication trust gaps are a session problem, not a factor problem. FIDO2 meaningfully improves the login ceremony, but enterprise risk often begins after the authenticator has done its job. Session hijacking, token theft, and consent abuse all live beyond the boundary of factor verification, which means IAM teams cannot treat phishing-resistant login as the end state. The practitioner conclusion is straightforward: authentication hardening without session governance leaves the primary attack surface intact.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when phishing leads to account compromise?
A: Accountability is shared, but security leadership owns the control environment that made impersonation succeed. Email authentication, browser trust configuration, access scoping, and incident reporting are governance responsibilities, not just end-user habits. If phishing can repeatedly turn into compromise, the control model is failing at the organisational level.
👉 Read our full editorial: FIDO2 passkeys do not close the enterprise authentication gap
