Notifications
Clear all
Topic starter
06/07/2026 9:41 am
TL;DR: Passkeys replace memorized secrets with device-bound cryptography and biometrics, reducing phishing and credential theft while improving login success and speed, according to Descope. The governance shift matters because identity programmes must now manage a mixed authentication estate without assuming passwords remain the primary risk surface.
NHIMG editorial — based on content published by Descope: Passkeys vs. Passwords: What’s the Difference?
By the numbers:
- Microsoft reports a 98% success rate with passkeys compared to just 32% for passwords.
- Google measured passkey logins averaging 14.9 seconds vs. 30.4 seconds for passwords.
- PayPal observed a 70% drop in ATO attempts after introducing passkeys.
Questions worth separating out
Q: How should security teams roll out passkeys without creating new identity gaps?
A: Roll out passkeys by application tier and assurance level, not by blanket mandate.
Q: Why do passkeys improve security but not eliminate identity risk?
A: Passkeys remove the shared secret that attackers usually steal, guess, or phish, which is a major improvement.
Q: What do organisations get wrong when replacing passwords with passkeys?
A: The most common mistake is treating passkeys as a simple factor replacement.
Practitioner guidance
- Rework authentication policy around device-bound assurance Define where passkeys are mandatory, where fallback factors are allowed, and which applications still require passwords during transition.
- Audit account recovery and enrolment flows Review proofing, helpdesk reset steps, and device re-registration to ensure they do not reintroduce weak or phishable paths into an otherwise passwordless programme.
- Map legacy fallback paths before rollout Inventory every place a password, OTP, or manual override still exists so you can avoid shadow authentication routes that undermine passkey adoption.
What's in the full article
Descope's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step passkey implementation guidance for teams planning a phased authentication transition.
- Practical comparison points for deciding where passwords can remain as fallback during rollout.
- Platform compatibility notes across browsers, operating systems, and SDK integrations.
- Examples of how to position passkeys alongside existing authentication workflows without breaking user access.
👉 Read Descope's analysis of passkeys versus passwords →
Passkeys vs passwords: are your identity controls ready?
Explore further
06/07/2026 9:57 am
Passkeys solve the shared-secret problem, but they do not solve the identity lifecycle problem. Passwordless authentication removes one of the oldest attack primitives in IAM, yet the real governance burden shifts to enrolment, recovery, revocation, and fallback. The control plane changes from password policy to device-bound identity assurance, which means programme owners have to govern the full authentication journey, not just the credential.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to the same report.
A question worth separating out:
Q: How do you know whether a passkey programme is actually working?
A: A passkey programme is working when password use, phishing success, and reset-related support demand all decline without increasing account recovery incidents or access exceptions. Track login success, fallback usage, recovery events, and the proportion of applications still outside the passkey policy boundary.
👉 Read our full editorial: Passkeys replace passwords, but the governance gap remains
