Notifications
Clear all
Topic starter
06/07/2026 9:35 am
TL;DR: Passwordless authentication is moving from optional to expected: Descope’s State of Customer Identity 2025 survey says 87% of organisations still use passwords for customer-facing apps, while 45% have deployed passkeys and 27% plan to within two years. The real challenge is migration discipline, not proof of concept, because hybrid auth will dominate the transition period.
NHIMG editorial — based on content published by Descope: Passwordless authentication trends: where we're headed
By the numbers:
- 87% of organisations still use password-based auth for customer-facing apps.
- 45% of organisations have already deployed passkeys in one or more apps.
- 75% of global consumers are now aware of passkeys.
Questions worth separating out
Q: How should security teams implement passwordless authentication without breaking customer journeys?
A: Use a staged rollout that keeps existing sign-in paths available while adding passkeys, magic links, or OTPs where they fit.
Q: Why do passwordless programmes still need strong recovery governance?
A: Because account recovery is often the easiest route back into a customer identity after the primary credential is removed.
Q: How do organisations know if passwordless authentication is actually working?
A: Look at adoption, abandonment, support volume, and takeover rates together.
Practitioner guidance
- Map every fallback path in your customer auth journey Inventory sign-in, recovery, and reset flows across all customer-facing applications, then document where passwords, OTPs, magic links, and passkeys overlap or diverge.
- Roll out passwordless in staged cohorts Start with new applications or low-risk user segments, then expand through progressive enrolment rather than forced migration.
- Align customer IAM and fraud teams on auth risk Create shared reporting for takeover attempts, recovery abuse, and login friction so security and fraud decisions use the same operational picture.
What's in the full article
Descope's full blog post covers the operational detail this post intentionally leaves for the source:
- Survey tables showing how customer IAM decision-makers are weighting passwords, passkeys, OTPs, and social login
- Examples of incremental deployment patterns from real organisations moving toward passwordless flows
- Product-specific rollout guidance for layering passwordless into existing authentication stacks
- Supporting detail on how major platforms are shaping consumer expectations for passwordless sign-in
👉 Read Descope's passwordless authentication trends analysis for 2026 →
Passwordless authentication in 2026: what IAM teams need to know?
Explore further
06/07/2026 9:49 am
Passwordless authentication is now a migration and governance problem, not a concept problem. The market has already moved past awareness, but most organisations still operate hybrid authentication stacks with passwords embedded in customer journeys. That means the real question is how to govern coexistence, recovery, and exception handling while reducing password dependence without widening exposure. Practitioners should treat the transition as an IAM operating-model change, not a feature rollout.
Passwordless programmes are converging with broader identity modernisation, so teams should expect the same governance pressure that has shaped NHI lifecycle work: visibility, recovery discipline, and consistent policy enforcement across states. The lesson is that authentication change fails when it is treated as a point solution rather than a governed transition.
A question worth separating out:
Q: What is the difference between passkeys and other passwordless methods in practice?
A: Passkeys provide the strongest phishing resistance because they use cryptographic keys bound to a device or authenticator, while methods like magic links and OTPs still rely on delivery channels that can be intercepted or abused. Teams should reserve passkeys for higher-assurance use cases and use weaker methods only where the risk profile supports them.
👉 Read our full editorial: Passwordless authentication is becoming table stakes for customer IAM
