The Incident That Didn't Happen
Nothing broke. No breach occurred. No credentials leaked. That's the point.
More than 7 billion passkeys are now in use worldwide, according to FIDO Alliance estimates reported at Authenticate 2026. Organizations deploying them at scale have effectively eliminated an entire class of authentication incidents: credential theft through phishing, session hijacking via stolen passwords, and brute-force attacks against shared secrets.
The incident that didn't happen is the story. While passkeys have matured from concept to ubiquity in four years, most security teams still treat them as a supplemental control rather than the primary authentication layer. They're running passkeys alongside passwords, SMS one-time codes, and other phishable fallbacks. The architecture says "defense in depth," but the attack surface says "weakest link wins."
Timeline of Passkey Adoption
2022: Passkeys launched with platform support from Apple, Google, and Microsoft. Syncing credentials across devices became standard. Most organizations viewed them as experimental.
2023-2024: Early adopters began production deployments. Passkeys moved from pilot programs to customer-facing authentication flows. Passwords remained the default, with passkeys offered as an optional upgrade.
2026: FIDO Alliance estimates 7 billion passkeys in use. Major brands and governments have deployed them at scale. Organizations report losing an average of 32,400 hours of frontline work annually due to authentication issues, a metric that passkeys directly address.
Current state: Passkeys work. Adoption is real. But most implementations still maintain password-based fallbacks, preserving the exact attack vector passkeys were designed to eliminate.
Missing Controls
The missing control isn't technical. It's operational commitment.
No sunset plan for legacy authenticators. Organizations deployed passkeys but kept passwords active "just in case." Every account with a password fallback remains vulnerable to credential stuffing, phishing, and session theft. You've added a secure front door but left the back door unlocked.
No enforcement of phishing-resistant authentication for privileged access. If your IAM admins, directory administrators, or vault operators can still authenticate with a password and push notification, you're one social engineering call away from domain compromise. Passkeys sit unused while the highest-value accounts rely on the weakest methods.
No lifecycle policy for credential types. You have processes for rotating vault secrets and reviewing entitlements. Do you have a process for deprecating authentication methods? Most teams don't. Passwords persist because no one owns the decision to retire them.
Incomplete coverage for non-human identities. Service accounts, API keys, and CI/CD pipelines still authenticate with static secrets. FIDO Device Onboard (FDO) provides a standard for zero-touch device provisioning with cryptographic identity, but adoption lags. Your IoT deployment scales to thousands of endpoints, each manually configured with a pre-shared key.
Standards and Requirements
FIDO2 specifies phishing-resistant authentication using public key cryptography. The private key never leaves the device. The credential can't be phished, intercepted, or reused across sites. This isn't a recommendation. It's the design.
NIST SP 800-63B (Digital Identity Guidelines) defines Authenticator Assurance Levels. AAL3 requires cryptographic proof of possession. Passwords don't qualify. Neither do SMS codes or push notifications. If you're handling sensitive data or privileged access, AAL3 is the floor.
FIDO Device Onboard defines how IoT devices establish cryptographic identity on first boot, locate their owner, and receive credentials without manual intervention. The 2.0 specification introduced Delegated Ownership, enabling remote sites to onboard hardware securely without on-site configuration. If you're deploying edge devices at scale, FDO eliminates the shared secret problem at the machine layer.
Zero Trust frameworks (NIST SP 800-207, CISA Zero Trust Maturity Model) require continuous verification of identity. That verification must be cryptographic. Shared secrets don't meet the standard. Passkeys do.
Action Items for Your Team
1. Make Passkeys the Primary Authentication Method
Set a deprecation date for passwords. Ninety days is reasonable for most organizations. Communicate it clearly. Provide enrollment support. Then enforce it. If users can still fall back to passwords, they will.
Action: Update your authentication policy to require FIDO2 credentials for all interactive logins. Remove password-based fallbacks from your identity provider configuration. Monitor authentication logs for legacy method usage and block it at the policy enforcement point.
2. Enforce Phishing-Resistant Authentication for Privileged Accounts
Your IAM admins, directory operators, and vault administrators should authenticate with passkeys or Multi-Factor Cryptographic Devices. No exceptions. If an attacker can phish a privileged account, your entire control plane is compromised.
Action: Create a Conditional Access policy (or equivalent in your IdP) that enforces FIDO2 authentication for any role with write access to identity systems, directory objects, or secrets. Disable SMS and app-based one-time passwords for these accounts.
3. Build a Credential Lifecycle Framework
You manage entitlements. Manage authentication methods the same way. Define which credential types are authorized, under what conditions, and for how long. Track usage. Revoke deprecated methods.
Action: Extend your Identity Governance and Administration (IGA) platform to include authentication method as a reviewable attribute. Include it in your next Certification Campaign. If a user account still has a password enabled six months after passkey deployment, flag it.
4. Apply Cryptographic Identity to Non-Human Accounts
Service accounts and IoT devices authenticate with secrets you distribute manually or embed in configuration files. FIDO Device Onboard provides a standard for zero-touch provisioning with cryptographic proof of identity. Use it.
Action: Evaluate FDO for your next IoT deployment. For existing service accounts, migrate to short-lived certificates issued by your PKI or vault. Eliminate static API keys from CI/CD pipelines. Rotate credentials programmatically using Vault Rotation policies.
5. Measure Authentication Friction as a Security Metric
FIDO Alliance research found that organizations lose an average of 32,400 hours annually to authentication issues. That's not just productivity loss. It's attack surface. Frustrated users bypass controls, share credentials, or choose weaker methods.
Action: Instrument your authentication flows. Measure time-to-authenticate, fallback usage, and support ticket volume. If users are falling back to passwords or calling the help desk for MFA resets, your phishing-resistant controls aren't working.
Passkeys didn't fail. They succeeded at scale. The failure is organizational: deploying a cryptographic control while preserving the phishable fallback it was designed to replace. You can't eliminate credential theft if credentials still exist. Set a sunset date. Enforce it. Measure the outcome.
