Notifications
Clear all
Topic starter
07/06/2026 11:29 am
TL;DR: Passkeys are gaining momentum as Apple, Google, Microsoft, FIDO Alliance and major brands report broad support and adoption, while consumers increasingly recognise the model and regulators accept it for secure authentication. The real challenge is not whether passkeys work, but how to roll them out without breaking recovery, consistency or hybrid access paths.
NHIMG editorial — based on content published by Strivacity: Passkeys are taking off, what is still standing in the way, and how to roll them out
By the numbers:
- More than 15 billion accounts are enabled for passkeys.
- Google has logged 2.5 billion passkey authentications across 800 million accounts.
- Amazon reports 175 million users with passkeys.
Questions worth separating out
Q: How should security teams roll out passkeys without breaking customer login flows?
A: Start with an opt-in model, keep passwords plus MFA available during transition, and standardise one policy across all applications.
Q: Why do passkey programmes still fail if passwords are removed?
A: Removing passwords does not remove the need for recovery, enrollment and fallback governance.
Q: What do organisations get wrong about passkey adoption?
A: They often treat it as a front-end authentication change instead of a lifecycle and policy change.
Practitioner guidance
- Standardise a single passkey policy model Define where passkeys are preferred, where passwords remain available, and how step-up is triggered for sensitive transactions across every customer-facing application.
- Treat recovery as a high-assurance workflow Require stronger identity verification for device loss, device replacement and account rebind than you use for ordinary sign-in or self-service reset.
- Preserve secure fallback paths during migration Keep passwords plus MFA available for users who are not ready for passkeys, but prevent fallback paths from becoming the default weak link in the journey.
What's in the full article
Strivacity's full blog post covers the rollout detail this post intentionally leaves for the source:
- The customer education flow for introducing passkeys during sign-up and password reset journeys.
- The practical recovery choices for lost or replaced devices, including secure fallback design.
- The phased rollout pattern for moving from optional adoption to broader default use.
- The recommended approach for standardising passkeys across multiple apps and environments.
👉 Read Strivacity's analysis of passkey adoption and rollout strategy →
Passkeys in CIAM: what it means for login and recovery?
Explore further
07/06/2026 11:30 am
Passkeys are becoming a customer identity control, not a novelty feature. The adoption signals in the article show that ecosystem readiness has crossed a practical threshold, which means the remaining blockers are now governance and operational design. When authentication is easier to use and harder to phish, the question shifts to whether the organisation can standardise it across channels without creating exceptions that reintroduce legacy risk. Practitioners should treat passkeys as a mainstream CIAM control path, not a pilot.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant behaviour gap that identity programmes often underestimate.
A question worth separating out:
Q: How do you know if passkeys are actually improving security?
A: Look for fewer password-reset events, lower phishing exposure on supported journeys, and stable or improving completion rates for enrollment and recovery. If support tickets rise sharply or fallback use dominates, the programme may be shifting risk rather than reducing it. The best signal is improved assurance without degraded account access.
👉 Read our full editorial: Passkey adoption is reshaping customer login and recovery
