Topic starter
26/08/2026 11:51 am
TL;DR: Organisations face evolving AI-driven phishing pressure as passwordless authentication becomes more available, according to Yubico’s 2025 Global State of Authentication survey, which draws on responses from 18,000 employed adults and pairs that data with updates on device-bound passkeys, PIN enhancements, and expanded delivery options. The bigger issue is not whether passwordless authentication is available, but whether identity programmes can make phishing-resistant access usable, deployable, and governable at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “We’re excited for what’s to come – meet us in-person to find out why”.
By the numbers:
- Yubico’s 2025 Global State of Authentication survey draws on responses from 18,000 employed adults around the world.
Key questions
Q: What breaks when passkeys are used alongside weak fallback authentication?
A: The programme becomes only as strong as the fallback path.
Q: Why do passkey rollouts stall after the first adoption wave?
A: They stall when users see failed passkey attempts, stale credentials or awkward recovery flows.
Q: How can organisations tell whether authentication is actually phishing-resistant?
A: Authentication is phishing-resistant when a stolen code, password, or proxy cannot be reused to satisfy the login flow.
Practitioner guidance
- Map fallback authentication paths Identify where passwords, SMS, or other reusable factors still remain after passkey rollout and remove them where policy allows.
- Test passkey enrolment and recovery Validate what users experience during first use, lost-device recovery, and help desk-assisted reset so the control remains usable under real conditions.
- Standardise device replacement workflows Define how new hardware, shipping delays, and regional support affect credential replacement so users do not revert to weaker temporary access.
Bottom line: Passkeys reduce replayable credential risk, but they do not eliminate phishing pressure or the need for governed fallback paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishing resistance is now a deployment problem, not an authentication concept problem. The market has moved past the question of whether passkeys are stronger than passwords. The harder issue is whether organisations can deploy them consistently enough that users do not fall back to weaker factors, unmanaged recovery flows, or exception handling. For IAM teams, the control objective has shifted from credential strength alone to control coverage across the full authentication path.
A question worth separating out:
Q: Should teams prioritise passkeys over other IAM improvements?
A: Only when the organisation has already addressed recovery, device trust, and lifecycle governance. Passkeys can remove a major phishing and password-reuse problem, but they do not fix identity proofing gaps, poor offboarding, or weak account recovery. The right sequence is to align passkeys with the controls that determine whether authentication remains trustworthy over time.
👉 Read our full editorial: Passkeys, phishing resistance, and authentication trends in 2025