Topic starter
10/07/2026 9:18 pm
TL;DR: Passkey adoption is already mainstream, with 87% of enterprises deploying or having deployed it, Google reporting 2.5 billion sign-ins across 800 million accounts, and NIST classifying syncable passkeys as AAL2-compliant, according to Authsignal. The hard part is not support, but operating enrollment, recovery, step-up, fraud detection, and orchestration as one authentication system.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “World passkey day: How to deliver passkeys at scale in 2026”.
Key questions
Q: What breaks when passkeys are treated as a full replacement for authentication assurance?
A: What breaks is the assumption that a phishing-resistant sign-in method automatically satisfies every access requirement.
Q: Why do passkey recovery flows create more risk than the passkey itself?
A: Because recovery often falls back to the weakest available channel, such as email, SMS, or support-driven identity checks.
Q: How can security teams know whether passkey adoption is actually improving security?
A: Look for fewer phishing-driven account compromises, lower reliance on password resets, and consistent enrolment success across user groups.
Practitioner guidance
- Define enrollment as a policy workflow Move passkey prompts out of static settings pages and into controlled moments such as post-login, registration, or re-engagement, with explicit rules for who is eligible and when re-prompting is allowed.
- Harden recovery above the original sign-in factor Require recovery paths that are harder to abuse than the passkey itself, using more than one signal and avoiding downgrade routes that rely only on email or weak knowledge checks.
- Separate orchestration from the IDP Keep session issuance in the identity provider, but move contextual decisions, factor management, and lifecycle events into a dedicated orchestration layer that can apply the same policy across web, mobile, and contact center flows.
Bottom line: Passkey scale is constrained less by technology support than by whether the surrounding authentication system is governed as a whole.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:41 pm
Passkey programmes now fail more often on governance than on cryptography. The article shows that support for passkeys is no longer the bottleneck. The bottleneck is whether organisations can operate enrollment, recovery, step-up, and fraud response as one authentication system. For IAM leaders, that means the control problem has shifted from credential adoption to authentication orchestration.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations run passkeys through the IDP or a separate orchestration layer?
A: If the organisation needs policy-driven enrollment, recovery, risk-based step-up, and multi-channel support, a separate orchestration layer is usually the better control point. The IDP can still issue sessions, but orchestration is where contextual decisions and lifecycle events stay coherent across the journey.
👉 Read our full editorial: World passkey day shows passkey scale still depends on orchestration