Topic starter
06/07/2026 9:35 am
TL;DR: Passwordless authentication is moving from optional to expected: Descope’s State of Customer Identity 2025 survey says 87% of organisations still use passwords for customer-facing apps, while 45% have deployed passkeys and 27% plan to within two years. The real challenge is migration discipline, not proof of concept, because hybrid auth will dominate the transition period.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Passwordless Authentication Trends: Where We’re Headed”.
By the numbers:
- 87% of organisations still use password-based auth for customer-facing apps.
- 45% of organisations have already deployed passkeys in one or more apps.
- 27% of organisations plan to implement passkeys within the next two years.
Key questions
Q: How should IAM teams implement passwordless authentication without breaking customer journeys?
A: Start with hybrid deployment in new or low-risk flows, then expand to existing journeys once recovery, fallback, and step-up rules are proven.
Q: Why do passwords still persist even when passkeys are available?
A: Passwords persist because migration is harder than awareness.
Q: What signals show that passwordless adoption is actually working?
A: Look for fewer password resets, fewer help desk unlock requests, lower use of workarounds, and stable clinician throughput during login-heavy periods.
Practitioner guidance
- Prioritise passkeys in new customer journeys Start with new apps and high-volume login paths where enrolment friction is lowest and support savings are easiest to measure.
- Design hybrid authentication as a migration state Keep passwords, passkeys, magic links, and OTPs in one governed model so users can move gradually without losing access.
- Map recovery and fallback rules before rollout Define how users recover accounts, switch devices, and escalate to step-up verification when the password is removed from the main flow.
Bottom line: Passwordless authentication is moving from a specialist improvement to a mainstream customer IAM expectation, but most organisations still depend on passwords in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:49 am
Passwordless authentication is now a customer IAM governance issue, not a feature preference. The article shows that awareness, adoption, and consumer expectation are all moving in the same direction, while passwords remain stubbornly embedded in production stacks. That gap is no longer about technical feasibility, it is about migration governance, rollout discipline, and whether identity teams can modernise without destabilising access journeys.
Passkey adoption is creating an expectation gap for customer IAM teams. Consumers are becoming familiar with passwordless sign-in faster than many organisations can redesign their flows, which means authentication roadmaps now have a timing problem as well as a technical one. Teams should plan for a period where password, passkey, and fallback methods coexist, because the transition is operational, not binary.
A question worth separating out:
Q: Should organisations prioritise passkeys over OTPs and magic links?
A: Usually yes, when phishing resistance and device binding matter most. Passkeys offer stronger assurance, while OTPs and magic links can still be useful as transitional methods or lower-assurance alternatives in a phased customer IAM rollout.
👉 Read our full editorial: Passwordless authentication is becoming table stakes for customer IAM