Topic starter
06/06/2026 1:50 am
TL;DR: Passkeys are moving from niche authentication option to mainstream IAM discussion, with OneSpan citing Gartner data that 72% of authentication-related inquiries in 2025 were about passwordless authentication and noting a 93% login success rate for passkeys versus 63% for passwords. Passwordless change is no longer just a UX decision, because it reshapes authentication resilience, rollout strategy, and control boundaries across consumer and workforce identity.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “The Authentication Newsletter for May 2026”.
By the numbers:
- Gartner found that 72% of authentication-related inquiries in 2025 were about passwordless authentication.
- Passkeys were shown with a 93% login success rate compared with around 63% for passwords.
Key questions
Q: How should security teams roll out passkeys without creating support problems?
A: Start with recovery design, user communication, and help desk readiness.
Q: When do passkeys create more operational risk than they reduce?
A: They create more risk when teams deploy them before defining device loss recovery, origin stability, and cross-platform testing.
Q: What breaks when passkey recovery is not governed properly?
A: The programme falls back to the weakest legacy recovery path, which attackers often target first.
Practitioner guidance
- Map authentication populations by assurance need Separate consumer, workforce, privileged, and regulated journeys before selecting a passkey model.
- Design fallback and recovery paths first Document what happens when a passkey is lost, a device changes, or a user must switch factors.
- Run passkeys in parallel with existing methods Introduce passwordless options alongside current authentication so adoption can scale without forcing a hard cutover.
Bottom line: Passkeys are changing IAM planning because authentication design now affects governance, support, and rollout strategy, not just login experience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:10 am
Passkeys are now an authentication governance issue, not just a login improvement. Once organisations move beyond pilot use, the real question becomes how authentication policy, fallback paths, and recovery workflows are governed across mixed populations. That is where IAM teams must stop treating passwordless adoption as a feature choice and start treating it as an operating model decision.
A question worth separating out:
Q: Should organisations build or buy a passkey solution?
A: Choose based on operating capacity, not ideology. Building can give tighter control and customisation, but it demands more engineering and governance ownership. Buying can speed deployment, but the organisation still has to own policy, recovery, assurance, and long-term authentication strategy.
👉 Read our full editorial: Passkeys, passwordless adoption and the identity trade-off for IAM teams