Topic starter
07/06/2026 11:29 am
TL;DR: Passkey adoption is accelerating as platform support, smartphone penetration, rising consumer awareness and regulatory acceptance converge, according to Strivacity, but recovery, ecosystem lock-in and inconsistent user experiences still block clean rollout. The governance problem is no longer authentication capability, but whether CIAM programmes can standardise recovery and hybrid access without reintroducing password-era friction.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “Passkeys and passwordless authentication: Trends, challenges, and how to get started”.
By the numbers:
- More than 15 billion accounts are enabled for passkeys, according to Strivacity.
- Google has logged 2.5 billion passkey authentications across 800 million accounts, according to Strivacity.
- Amazon reports 175 million users with passkeys, according to Strivacity.
Key questions
Q: How should organisations roll out passkeys without breaking customer login flows?
A: Start with journeys that already tolerate fallback, such as signup, account recovery, and step-up authentication.
Q: What breaks when passkey recovery is not governed properly?
A: The programme falls back to the weakest legacy recovery path, which attackers often target first.
Q: When should organisations keep passwords and MFA alongside passkeys?
A: Keep them during transition periods, for customer segments that are not yet passkey-ready, and wherever recovery assurance is still being proven.
Practitioner guidance
- Standardise passkey policy across all customer apps Define one approved customer authentication pattern for enrollment, sign-in, and recovery so every app uses the same assurance rules and fallback sequence.
- Design recovery as a governed assurance step Require secure fallback options, device-loss handling, and identity verification for higher-risk accounts before you expand passwordless sign-in.
- Keep hybrid access available during rollout Support passwords plus MFA alongside passkeys while adoption matures, so early failures do not block customers who are not yet ready to switch.
Bottom line: Passkeys improve customer authentication, but their real governance challenge is recovery, not cryptography.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
07/06/2026 11:30 am
Passkey adoption is now a customer identity governance issue, not just an authentication upgrade. Once passkeys move beyond pilot use, the real decision shifts from whether they work to whether the organisation can govern them consistently across applications, devices and recovery journeys. That makes CIAM architecture, not just login UX, the critical control plane. The practitioner conclusion is clear: passwordless programmes succeed only when the governing model is consistent end to end.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Why do passkeys need a single enterprise-wide policy?
A: Because inconsistent browser, device and app behaviour quickly creates different recovery paths and different user expectations. A single policy gives CIAM teams one assurance model, one customer message and one way to govern sign-in across the portfolio.
👉 Read our full editorial: Passkey adoption is reshaping customer login and recovery
This post was modified 3 days ago by NHI Mgmt Group