Passkeys Explained: What They Mean for Your Business

Every security talk of the last fifteen years ended with the same advice: longer passwords, different ones everywhere, change them regularly. It was reasonable guidance and it never really worked, because it asked ordinary people to behave like password managers.

The industry has quietly given up on that approach. Passkeys replace the password entirely with something your device holds and your face, fingerprint or PIN unlocks. Microsoft, Google and Apple are all pushing hard in this direction, which means the question for your business is no longer whether this arrives, but when you deal with it.

What passkeys actually are

When you create one, your device generates a pair of cryptographic keys. The private key never leaves the device and is unlocked by your fingerprint, face or device PIN. The public key goes to the service you are signing in to.

Signing in means the service sends a challenge, your device signs it, and the service checks the signature. Nothing secret travels across the network, and the service never stores anything an attacker could reuse.

Underneath, this runs on the FIDO2 and WebAuthn standards, which is why passkeys work across different platforms rather than locking you into one vendor.

Why this beats a password plus a code

The important property is not convenience, it is that passkeys are phishing-resistant by design.

A convincing fake login page can capture a password. It can also capture the six-digit code your app generates, because the user simply types it in and the attacker relays it in real time. Modern phishing kits do exactly this, which is why traditional multi-factor authentication stops being the reassurance it once was.

Passkeys close that gap because the credential is bound to the real domain. On a lookalike site, your device does not offer the passkey at all. There is nothing to type, so there is nothing to hand over. The attack does not fail because the user was alert. It fails because the credential cannot be used anywhere else.

The other benefit is quieter: nothing to forget, nothing to reset, and no support calls at eight in the morning about a locked account.

The honest caveats

Anyone telling you passwordless is a finished story is selling something. Real limitations remain.

• Coverage is uneven. Major platforms support it well. Your accounting package, your industry portal and that supplier system from 2012 probably do not.
• Recovery needs thought. If someone loses their phone, how do they get back in? A weak recovery route undoes the whole benefit, because attackers will simply attack the recovery route instead.
• Shared accounts get awkward. A social media login used by four people fits this model badly.
• Passkeys are per device or per ecosystem. Synced passkeys make this easier, but people with an Android phone and a Windows laptop still hit friction.
• Enrolment is the weak moment. If someone can register a new credential using only a password, you have added convenience rather than security.

In practice you will run a mixed environment for years. That is fine, as long as it is deliberate rather than accidental.

Where to start with passkeys

Begin where the damage would be worst. Administrator accounts first, then finance, then anyone with access to customer data. These are also the accounts attackers target, so the effort lands where it matters.

Then cover your main identity provider. If your company runs on Microsoft 365, that single sign-in protects most of what people touch during the day, and it is where passkeys deliver the most value for the least disruption.

Sort out recovery before you roll out, not after. Register a second method for every user and make the reset process something a person verifies, not an automated flow anyone can trigger.

Keep a password manager anyway. Everything that does not yet support passkeys still needs long, unique passwords, and that is not going away this year.

What to tell your team

Keep it simple. They are not learning a new security concept, they are learning that signing in now works like unlocking their phone. Most people find it faster within a week, and the complaints you get are almost always about the enrolment step rather than daily use.

Enrol people in person or over a call the first time. It takes two minutes, prevents a wave of confusion, and lets you confirm identity properly at the one moment when that matters most.

Let us handle the rollout

The concept is straightforward. The rollout is where it gets fiddly: conditional access rules, recovery paths, devices that are not managed, the handful of systems that will never support this, and the question of what happens when someone leaves.

That is our work. At EvolvingDesk we introduce passkeys in stages, starting with the accounts that carry the most risk, configure the policies so old sign-in methods cannot quietly stay open as a back door, and set up a recovery process that does not become the weakest link. We handle enrolment with your team so nobody is left staring at a prompt they do not recognise.

You end up with sign-ins that phishing cannot defeat, fewer password resets, and staff who find security less annoying than before. That combination is rarer than it should be.

Curious whether your environment is ready? Plan a call and we will map out what could move first.

Read more

• How to keep remote workers productive and secure
• What happens to your data when an employee leaves
• Managed IT services at EvolvingDesk

Background: the FIDO Alliance introduction to passkeys and the Microsoft documentation on passwordless sign-in.