Topic starter
16/08/2026 1:11 pm
TL;DR: The 2025 FIDO report shows 75% of global consumers now know about passkeys, 48% of the top 100 websites already support them, and nearly half of consumers have abandoned purchases after forgetting passwords, according to Descope. Passwordless adoption is no longer a UX experiment; it is becoming a customer IAM control and conversion issue at the same time.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “2025 FIDO Report: The Passwordless Future”.
By the numbers:
- 75% of global consumers are now aware of passkeys, according to Descope.
- 48% of the top 100 websites reviewed by the FIDO Alliance offered passkeys as a login method, according to Descope.
Key questions
Q: How should teams implement passkeys in customer IAM without breaking existing sign-in journeys?
A: Start with the journeys that create the most friction, then define where passkeys are primary, where fallback is allowed, and which recovery paths remain acceptable.
Q: Why do passwords create both security and conversion risk in customer identity flows?
A: Passwords depend on memory, reuse, and reset workflows, all of which create friction and attack surface.
Q: What are the signs that password-only authentication is failing in practice?
A: Password-only authentication is failing when a valid password is enough to grant access from an unusual place, device, or time without any additional checks.
Practitioner guidance
- Define a passkey-first authentication policy Set criteria for which customer journeys should use passkeys by default, which must allow alternate factors, and which high-value actions still need step-up verification.
- Inventory fallback and recovery paths Document every recovery method, device exception, and support-assisted login path so you can see where passwordless still depends on weaker controls.
- Measure sign-in friction alongside risk Track abandonment, reset volume, authentication completion time, and account takeover indicators together rather than treating UX and security as separate dashboards.
Bottom line: Passkeys are shifting customer IAM away from memorised secrets and toward device-bound authentication flows that reduce both phishing exposure and sign-in friction.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/08/2026 1:13 pm
Passkeys are becoming a customer IAM control, not just an authentication option: Once a material share of users expect passwordless sign-in, the control boundary shifts from login convenience to account lifecycle design. That means recovery, device binding, and fallback logic become part of the identity policy, not afterthoughts. Practitioners should treat passkey adoption as programme design, not feature roll-out.
Passwordless adoption is now a customer IAM governance issue: Once consumers recognise passkeys and major websites support them, the practical question becomes whether an organisation can replace password recovery with stronger account journeys. That requires policy decisions about fallback, support, and assurance, not just a UI change.
A question worth separating out:
Q: Should customer IAM teams keep passwords as a fallback when deploying passkeys?
A: Yes, in most environments they should keep controlled fallback paths during migration, but those paths need explicit boundaries. The goal is to reduce password dependence over time, not to let fallback methods become the permanent primary control for customer authentication.
👉 Read our full editorial: Passkeys are reshaping passwordless authentication for customer IAM