Notifications
Clear all
Topic starter
14/08/2026 6:32 pm
TL;DR: Passkey adoption is accelerating, with 87% of enterprises actively deploying or piloting them in 2026 and Google research showing passkey-protected accounts are 99.9% less likely to be compromised than password-only accounts, according to RSA Security and Google. The real challenge is not whether passkeys work, but whether IAM teams can manage device binding, recovery, and lifecycle without recreating old password problems in a new form.
NHIMG editorial — based on content published by RSA Security: Why Passkeys Are the Future of Passwordless Authentication
By the numbers:
- In 2026, 87% of enterprises are actively deploying or piloting passkeys, up from 53% just two years prior.
- According to Google’s research, accounts protected by passkeys are 99.9% less likely to be compromised than password-only accounts.
Questions worth separating out
Q: How should security teams govern passkey issuance in enterprise identity systems?
A: Security teams should treat passkey issuance as a governed identity event, not a simple enrollment action.
Q: Why do passkeys change the risk profile for human identity programmes?
A: Passkeys remove the shared secret that phishing, replay, and password reuse depend on.
Q: What do security teams get wrong about passwordless authentication?
A: The most common mistake is treating passwordless as a user-experience upgrade instead of an identity control change.
Practitioner guidance
- Map every authentication path before rollout Inventory VPNs, cloud apps, privileged workstations, and any legacy system that still depends on passwords or phishable MFA.
- Use device-bound passkeys for privileged and regulated access Set device-bound passkeys as the default for administrator accounts, sensitive business functions, and environments with compliance requirements.
- Define passkey recovery and revocation rules up front Document what happens when a device is lost, a user changes devices, or an employee leaves the company.
What's in the full article
RSA Security's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step enterprise rollout guidance for moving from password-based sign-in to passkeys across hybrid environments.
- Specific implementation notes on device-bound versus synced passkeys for enterprise, privileged, and consumer-facing use cases.
- Lifecycle handling details for enrollment, device loss, employee departure, and recovery within a central administration plane.
- Practical adoption measures such as pilot design, fallback authentication, and help desk impact tracking.
👉 Read RSA Security's blog on why passkeys are replacing passwords →
Passkeys and passwordless access: are your controls ready?
Explore further
14/08/2026 6:38 pm
Passkeys solve the phishable secret problem, but they do not eliminate identity governance. Moving from passwords to cryptographic authenticators removes a major attack path, but the organisation still has to govern enrolment, recovery, and revocation. Human identity risk shifts from secret theft to lifecycle control. The practitioner conclusion is straightforward: the control surface changes, not the need for governance.
Passkeys are a useful reminder that authentication improvements only become durable when the surrounding identity programme can govern enrolment, recovery, and revocation. Teams that treat passwordless as a point solution will likely recreate the same operational sprawl in a new control plane.
A question worth separating out:
Q: What should organisations do when an employee loses a passkey device?
A: They should revoke or recover the credential through a documented process that is tied to the user’s identity record and access level. The response should be defined before rollout, especially for privileged users. If recovery is improvised, the organisation creates a new bypass path that weakens the control it intended to strengthen.
👉 Read our full editorial: Passkeys are replacing passwords, but lifecycle control still matters
