What should organisations do when passkeys are not enough on their own?

Why This Matters for Security Teams

Passkeys are a strong step forward for authentication, but they do not solve what happens after a user or workload gets in. Once a session is active, attackers can still abuse OAuth consent, steal tokens from endpoints, or pivot through overly broad permissions. NHI Mgmt Group research shows that 97% of NHIs carry excessive privileges, which is a useful reminder that access scope often creates more damage than login weakness. The same principle applies to human sessions: the credential may be modern, but the blast radius is still governed by authorization.

Security teams should treat passkeys as one layer in a broader control stack that includes session binding, short-lived tokens, step-up controls for high-risk actions, and monitoring for recovery abuse. That aligns with the direction of the NIST Cybersecurity Framework 2.0, which emphasises governance, access control, and continuous monitoring rather than a single preventative mechanism. For identity-specific failures, see the patterns in the Schneider Electric credentials breach, where credential compromise became operational risk because downstream controls were not tight enough.

In practice, many security teams encounter token abuse and consent drift only after a session has already been misused, rather than through intentional detection of unusual post-login behaviour.

How It Works in Practice

The practical response is to design for “login is not the finish line.” After passkey authentication, organisations should tighten the session itself: bind it to device signals where feasible, shorten access token lifetimes for sensitive applications, and require re-authentication or step-up approval before privileged actions. For NHI and workload use cases, the same logic applies through JIT credentials, ephemeral secrets, and workload identity, because long-lived bearer tokens are hard to contain once exposed. NHI Mgmt Group guidance on the Schneider Electric credentials breach illustrates how quickly a valid credential can be turned into lateral movement when governance is thin.

Authorisation should also be evaluated at request time, not assumed from the original login. Current practice is moving toward intent-based controls, where a system checks what the user or agent is trying to do, from which device, in which context, and with what risk profile. That is more aligned with NIST Cybersecurity Framework 2.0 and with zero trust thinking: trust no session indefinitely, and do not let a successful login become standing permission. Teams should log consent grants, monitor recovery channel changes, flag unusual token issuance, and review endpoint integrity before granting access to sensitive resources.

• Use short token TTLs for admin actions and high-value data paths.
• Bind sessions to device posture or cryptographic device proof where possible.
• Require re-approval for new OAuth scopes, recovery events, and privilege escalation.
• Track anomalous behaviour such as impossible travel, token reuse, and consent spikes.

These controls tend to break down in distributed SaaS estates with weak token telemetry and inconsistent device trust because the session can move faster than the detection logic.

Common Variations and Edge Cases

Tighter session control often increases user friction and operational overhead, so organisations must balance containment against usability and support cost. There is no universal standard for exactly how much re-authentication is enough; current guidance suggests calibrating it to business criticality, data sensitivity, and fraud exposure. Low-risk workflows may tolerate longer sessions, while payment, admin, and recovery flows usually justify much stricter rules.

Edge cases matter. Shared devices, service desks, federated identity, and high-availability production tooling can all make device binding less reliable. In those environments, security teams may need alternative signals such as managed-device attestation, network context, or policy-driven access checks. The broader lesson is consistent with NHI governance research: when secrets and tokens are durable, compromise lasts longer than the login event itself. That is why the remediation gap highlighted in NHI Mgmt Group research is so important, especially when paired with the access-control expectations in NIST Cybersecurity Framework 2.0.

For organisations handling agentic or workload-style access, the same caution applies to autonomous systems that can chain tools and requests without human pacing. The safer pattern is short-lived, context-aware permission with continuous monitoring, not a one-time authentication win.

Related resources from NHI Mgmt Group

• Why do passkeys matter more in banking than in many other apps?
• How should organisations deploy passkeys for enterprise access?
• Should organisations replace passwords everywhere with passkeys immediately?
• When does MFA stop being enough on its own?