Topic starter
22/07/2026 4:35 pm
TL;DR: Passkeys replace reusable passwords with phishing-resistant cryptographic credentials, but Bitwarden argues that recovery paths, shared access, service accounts, and legacy sign-ins still leave organizations exposed. The shift makes authentication stronger, yet also exposes the broader identity stack that conventional login-focused security often ignores.
Editorial analysis by NHI Mgmt Group, based on content published by Bitwarden: “Building a smarter path to passkeys for stronger, more complete credential security”.
Key questions
Q: What should organisations do when passkeys are not enough on their own?
A: Add session and authorization controls that limit damage after login.
Q: Why do passkeys improve security but not eliminate identity risk?
A: Passkeys remove the shared secret that attackers usually steal, guess, or phish, which is a major improvement.
Q: What breaks when recovery flows are weaker than primary authentication?
A: Privilege controls become easy to route around.
Practitioner guidance
- Map every recovery path Inventory backup codes, helpdesk reset flows, device replacement processes, and delegated recovery approvals so they are reviewed alongside the primary passkey journey.
- Govern non-human credentials in parallel Track service accounts, OAuth tokens, SaaS integrations, and other machine credentials as a separate control surface instead of assuming passkey adoption reduces their risk.
- Remove shared access dependencies Identify where shared accounts still support business operations and replace them with accountable, individually managed access paths wherever the application can support it.
Bottom line: Passkeys reduce phishing exposure by removing reusable secrets from the primary sign-in flow, but they do not automatically modernise the rest of IAM.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:40 pm
Passkeys do not fix password-era IAM by themselves: The control improvement is real, but it only applies to the primary sign-in path. If recovery flows, shared access, and service accounts still operate on older assumptions, the programme remains partially password-era in practice. The practitioner conclusion is that authentication modernisation must be judged across the whole identity stack, not by login strength alone.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How should IAM teams govern passkeys across multiple platforms?
A: Treat passkeys as lifecycle-managed authenticators, not as a one-time login feature. Define where they are stored, how they sync, who can share them, and how they are deleted during offboarding. The main failure mode is inconsistent control across Apple, Google, and Microsoft ecosystems, which creates invisible governance drift even when the user experience looks seamless.
👉 Read our full editorial: Phishing-resistant passkeys expose the limits of password-era IAM