Topic starter
11/11/2026 5:59 pm
TL;DR: The operational risks are different even when the underlying authenticator is the same, and Secfense says workforce and customer deployments diverge sharply on device control, recovery, fraud exposure and compliance. Identity teams need separate architecture decisions because the operational risks are different even when the underlying authenticator is the same.
Editorial analysis by NHI Mgmt Group, based on content published by Secfense: “One Standard, Two Problems: Why Passkeys Work Differently for Workforce and Customers”.
Key questions
Q: Why is passkey recovery harder in customer identity than in workforce identity?
A: Passkey recovery is harder in customer identity because there is no managed device estate, help desk, or enforced joiner-mover-leaver process to rebind credentials after loss.
Q: What is the difference between device-bound and synced passkeys?
A: Device-bound passkeys stay on one physical device and are harder to export or replay elsewhere, while synced passkeys move through cloud services across multiple devices.
Q: How do passkeys work in workforce identity systems?
A: Passkeys replace passwords with public-key authentication, so the user proves possession of a registered authenticator instead of typing a shared secret.
Practitioner guidance
- Define separate passkey operating models Map workforce and customer identity to different authentication policies, recovery paths, and rollout criteria instead of treating them as one programme.
- Treat recovery as a primary control Document who can restore access, what verification is required, and which fallback methods remain available when the authenticator is lost.
- Set device policy before enrollment Decide whether the default model is managed-device binding, synced passkeys, or a mixed approach, then align authenticator policy to that choice.
Bottom line: Passkeys do not remove identity-design trade-offs, because workforce and customer programmes face different device, recovery and assurance conditions.
Glossary terms: Passkey, FIDO2, Customer Identity And Access Management, Device binding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Passkeys are one standard, but identity governance is still context-specific. The cryptographic primitive is shared, yet the control environment is not. Workforce identity assumes managed devices, central administration, and structured support, while customer identity has to absorb device variability, self-service recovery, and higher fraud pressure. Practitioners should treat the standard as common infrastructure, not as a single deployment model.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What should auditors look for in passkey deployments?
A: Auditors should check whether passkeys are bound to phishing-resistant authentication, whether enrolment and recovery are tightly controlled, and whether logs are centralised for enrolment, reset, and step-up events. They should also verify device binding, fallback methods, and administrator override paths, because weak recovery or shared credentials can defeat the passkey control.
👉 Read our full editorial: Passkeys split into workforce and customer identity programmes