Topic starter
04/06/2026 2:59 pm
TL;DR: FIDO’s 2026 State of Passkeys shows consumer awareness reaching 90%, 75% enabling passkeys on at least one account, and 68% of organisations deploying, piloting, or rolling out passkeys for employee authentication, according to Descope’s summary of the report. The evidence says passwordless is moving from optional upgrade to operational baseline, while recovery, legacy compatibility, and rollout discipline still determine success.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “2026 FIDO Report: Passkeys at Global Scale”.
By the numbers:
- Consumer awareness has climbed to 90%, up from 75% in the 2025 World Passkey Day report.
- 68% of organizations are deploying, piloting, or rolling out passkeys for employee authentication.
Key questions
Q: How should security teams roll out passkeys without breaking account recovery?
A: Start with low-risk journeys, then define recovery as a controlled identity workflow rather than a convenience feature.
Q: When do passkeys deliver more value than passwords in enterprise environments?
A: Passkeys deliver the most value when organisations want stronger phishing resistance, lower user friction, and less reliance on shared secrets across many applications.
Q: How do you know if a passwordless rollout is actually working?
A: Look beyond go-live status and measure whether support tickets are falling, adoption is stable across user groups, and users are not bypassing the new process.
Practitioner guidance
- Map your current fallback paths Identify where password reset, recovery codes, SMS fallback, or legacy MFA still sit behind the primary sign-in flow.
- Phase passkeys by application criticality Start with apps where phishing exposure or support volume justifies the change, then expand to adjacent systems once recovery and compatibility are proven.
- Standardise device and account recovery Define who can restore access, what evidence they must check, and which channels are allowed when a passkey is lost or unavailable.
Bottom line: Passkey adoption has moved from awareness to routine behaviour, which changes the IAM conversation from education to operational design.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:11 pm
Passwordless is now an operating model question, not an adoption curiosity. The article shows that awareness has matured into habitual use for consumers and active rollout for organisations. That changes the IAM problem from persuasion to governance, because the remaining friction is architectural rather than behavioural. Teams now have to decide how passkeys fit into broader authentication policy, not whether the market accepts them.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should IAM teams prioritise when legacy systems do not support passkeys well?
A: Prioritise the applications that matter most to security and user friction, then use phased rollout and compatibility testing to isolate where legacy constraints are unavoidable. The goal is to prevent old systems from becoming permanent exceptions that preserve password dependence. If the legacy layer cannot be modernised immediately, govern its fallback tightly and separately.
👉 Read our full editorial: Passkey adoption is crossing from awareness into enterprise habit