Passkeys Are Becoming the New Security Standard, but They Still Have Limits

Last Updated on August 30, 2026 by Michael Motha

For years, the internet has been trying to escape the password.

Passwords are difficult to remember, frequently reused, regularly stolen and increasingly vulnerable to sophisticated phishing and social-engineering campaigns. Passkeys emerged as one of the most promising alternatives because they replace reusable passwords with cryptographic credentials that can be unlocked using a device PIN, fingerprint or facial recognition.

Now, however, the passkey story is entering a more complicated phase.

Passkeys are rapidly moving into the mainstream, while security researchers are simultaneously exposing weaknesses in the systems surrounding them. In August 2026, researchers demonstrated several techniques that could abuse passkey implementations and device environments without breaking the underlying cryptography. At the same time, Microsoft announced that passkeys will become the default phishing-resistant authentication method in Microsoft Entra ID beginning September 1, 2026.

That creates an important distinction for businesses and consumers.

Passkeys are not suddenly “broken”. Rather, the industry is discovering that replacing passwords does not automatically eliminate every way an attacker can compromise an account.

The next phase of digital security will therefore be less about simply adopting passkeys and more about protecting the devices, operating systems, recovery processes, identity platforms and sessions that make passwordless authentication work.

Cybersecurity Snapshot

• Passkeys have moved rapidly from an emerging technology to a mainstream authentication method.
• FIDO reported 5 billion passkeys in active use globally in its 2026 research.
• 75% of surveyed consumers had enabled passkeys on at least some accounts, while 68% of surveyed organisations were deploying, piloting or rolling them out for employees.
• Microsoft is beginning a rollout that makes passkeys the default authentication experience for Microsoft Entra ID.
• Recent research has demonstrated attacks against passkey implementations without breaking the underlying cryptographic standard.
• Malware on an already-compromised device can become a critical part of the attack chain.
• Passkeys remain significantly more resistant to conventional phishing than passwords, but they are not a complete cybersecurity strategy.

Why Passkeys Became So Important

The basic weakness of a password is that the user has to know a secret and provide it to a website.

That creates opportunities for attackers.

A criminal can build a fake login page, send a convincing phishing message and persuade someone to enter their password. The attacker can then reuse that password against the legitimate service.

Credential stuffing creates another problem. If a password is reused across multiple websites and one service suffers a breach, attackers can try the stolen credential against other accounts.

Passkeys approach authentication differently.

Instead of asking the user to provide a reusable password, a passkey uses public-key cryptography. The private credential remains under the control of the authenticator, while the online service retains information that can be used to verify a legitimate authentication.

The result is a fundamentally different security model.

The FIDO Alliance’s passkey guidance describes passkeys as phishing-resistant credentials based on public-key cryptography. Major operating systems, browsers and passkey providers now support the technology.

NIST also recognises WebAuthn-based authentication as an example of phishing-resistant authentication because the authentication is cryptographically associated with the legitimate verifier rather than being a secret that a user manually types into a website.

That is a major advantage.

But it is only the beginning of the story.

The Passkey Paradox: Strong Cryptography, Complicated Systems

The recent security research surrounding passkeys reveals an important lesson.

An authentication system can use extremely strong cryptography and still have weaknesses elsewhere.

Researchers presenting several passkey-related attack techniques in August did not crack the mathematics behind FIDO authentication. Instead, the research focused on supporting systems, including operating-system behaviour, device trust, credential synchronisation and authentication material exposed during legitimate processes.

This distinction matters because consumers could easily misunderstand headlines suggesting that passkeys themselves have been defeated.

They have not.

The more accurate conclusion is that attackers are looking for weaknesses around the passkey.

That is similar to the security principle that protecting a front door with an extremely strong lock does not help if someone can obtain the keys from inside the building.

A passkey can prevent an attacker from simply stealing a password through a fake website. But if malware has already gained control of a trusted device, the attacker may be able to target the environment in which the passkey operates.

This is why passwordless authentication needs to be viewed as part of a broader security architecture.

What the New Passkey Attacks Actually Teach Us

The August research is particularly interesting because it changes the conversation from “Are passkeys secure?” to a more useful question:

“Where can an attacker intervene in the authentication chain?”

One area involves synchronised passkeys.

Modern platforms can allow credentials to be available across multiple devices, improving convenience and making account recovery easier. But synchronisation also introduces additional infrastructure that must be secured.

If malware compromises the environment where synchronised credentials are stored or managed, the attacker may attempt to abuse the surrounding mechanisms.

Other research has examined authentication data exposed by operating-system components or trusted sessions.

Again, this does not mean the cryptographic key has been mathematically broken.

It means that authentication systems are only as secure as the processes that surround the cryptographic operation.

That is an important lesson for enterprises.

Simply announcing that an organisation has “gone passwordless” does not mean the identity problem has been solved.

Device security, session protection, administrator privileges, recovery procedures and endpoint monitoring remain essential.

Microsoft Is Making Passkeys a Default

The significance of passkeys is becoming even clearer because major enterprise platforms are moving toward default adoption.

Microsoft announced in July that it would begin making passkeys the default phishing-resistant authentication method in Microsoft Entra ID from September 1, 2026. The company plans to progressively move users away from SMS and voice authentication, with Microsoft-provided SMS and voice authentication scheduled to end on February 1, 2027.

That is a major change for enterprise identity management.

For many years, organisations have treated passwords and SMS-based multifactor authentication as standard security controls. The move toward passkeys suggests the industry is now entering a different stage.

Authentication is becoming increasingly based on cryptographic credentials tied to trusted devices and local user verification.

Microsoft’s move is particularly significant because Entra ID sits at the centre of identity management for many enterprise environments.

If passwordless authentication becomes the default rather than an optional security feature, adoption could accelerate considerably.

It also means businesses need to prepare for the operational side of the transition.

Employees will need compatible devices.

IT teams will need recovery procedures.

Security teams will need to monitor identity events.

Administrators will need to understand how passkeys behave when devices are lost, replaced or compromised.

The technology may be simpler for users, but enterprise implementation remains a serious security project.

The Rise of Passkeys Is Not an End to Phishing

One of the biggest misconceptions about passkeys is that they make phishing disappear.

They significantly reduce one of phishing’s most important objectives: stealing reusable authentication secrets.

But phishing itself can have other goals.

Attackers may attempt to convince users to:

• Install malicious software
• Approve fraudulent transactions
• Reveal personal information
• Contact fake support teams
• Transfer money
• Give an attacker remote access
• Approve an unexpected login
• Download a malicious document

NIST’s current digital identity guidance makes an important distinction: phishing-resistant authentication protects authentication secrets and outputs against impostor verifiers, but organisations still need broader controls against other forms of social engineering and compromise.

That means passkeys should reduce the damage caused by credential phishing without creating a false sense of complete protection.

Why the Device Is Becoming the New Security Perimeter

As passwords disappear, the device becomes increasingly important.

A password can be changed remotely.

A compromised device can be much harder to reason about.

If an attacker controls a laptop or smartphone, they may be able to observe legitimate activity, manipulate applications or abuse trusted sessions.

This makes endpoint security increasingly inseparable from identity security.

The relationship is particularly important as smartphones become more capable AI computers.

TechKip’s analysis of on-device AI and smartphone security examines how more processing is moving directly onto personal devices. As smartphones increasingly become trusted computing environments, protecting those environments becomes essential to the security of digital identities.

The same principle applies to laptops, browsers and enterprise endpoints.

A passkey can provide strong authentication at the moment of login.

But the device must remain trustworthy after the login.

That is why future identity platforms are likely to combine authentication with continuous device-risk assessment.

Passkeys Are Part of a Bigger Shift Toward Continuous Identity

Traditional authentication largely asks one question:

“Did the correct person log in?”

Modern security increasingly asks several questions throughout a session:

“Is this still the correct person?”

“Is the device trustworthy?”

“Has the user’s behaviour changed?”

“Is the session behaving normally?”

“Has the account suddenly accessed sensitive resources?”

This is where passkeys and modern identity protection begin to converge.

TechKip previously examined how AI identity protection could become the next frontier in cybersecurity. That broader approach uses behavioural signals, device intelligence and contextual analysis to evaluate trust rather than relying exclusively on a single authentication event.

Passkeys can provide a strong foundation for that model.

They establish a more secure initial authentication mechanism.

Continuous identity security can then evaluate what happens afterwards.

The combination could become far more powerful than either technology alone.

What Businesses Should Do About Passkey Security

Organisations moving toward passkeys should avoid treating deployment as a simple replacement project.

The first step should be understanding which accounts require the strongest protection.

Privileged administrator accounts, financial systems, customer databases and sensitive business applications deserve particular attention.

Businesses should also consider the security of the endpoints used to authenticate.

A passkey on a well-protected, regularly updated device is very different from a passkey operating on a device already compromised by malware.

Recovery is another critical consideration.

What happens when an employee loses a phone?

What happens when a laptop is stolen?

How can an administrator recover an account without creating an easier route for attackers?

These questions need clear answers before an organisation removes older authentication methods.

The goal should be to make legitimate recovery secure without turning account recovery into the weakest link.

Why Passkeys Are Moving Into the Mainstream

The technology now has something it lacked several years ago: scale.

FIDO’s 2026 research reported 5 billion passkeys in active use, with awareness among consumers approaching universal levels. Its research across ten countries, including India, also found that 75% of consumers had enabled passkeys on at least some accounts.

That matters because authentication standards depend heavily on network effects.

Users are more willing to adopt passkeys when major websites support them.

Websites are more willing to support them when users already have compatible devices.

Device manufacturers have greater incentive to improve passkey experiences when adoption grows.

That creates a feedback loop.

The technology is moving beyond the experimental phase and toward mainstream infrastructure.

The remaining challenge is making it understandable.

Consumers do not need to understand public-key cryptography to use a passkey. But they do need to understand the importance of securing their devices, protecting recovery mechanisms and responding appropriately when something unusual happens.

The Privacy Advantage of Passkeys

Passkeys can also improve privacy.

Traditional password systems require services to store password verifiers, while phishing and credential reuse can create additional risks.

FIDO’s architecture is designed so that authentication credentials are associated with specific services rather than becoming a universal secret shared across websites. FIDO also states that biometric information used for local verification does not leave the user’s device.

That distinction is important.

When someone unlocks a passkey with a fingerprint or face, the website does not receive the biometric information itself.

The local device uses the biometric verification to authorise use of the cryptographic credential.

For consumers, that can create a more privacy-conscious authentication experience.

However, privacy still depends on the broader platform, device and service ecosystem.

Passkeys are not a substitute for responsible data management.

Could Passkeys Finally Kill the Password?

The password is unlikely to disappear overnight.

There are billions of existing accounts, legacy applications and systems that were designed around passwords.

Some services will take years to migrate.

There will also be environments where alternative authentication mechanisms remain necessary.

But the direction of travel is becoming clear.

Major technology companies are increasingly treating passkeys as the preferred successor to passwords rather than simply another authentication option.

Microsoft’s upcoming Entra ID changes are a strong example of that shift.

The more interesting question may therefore be when passwords become the exception rather than the default.

That transition could happen gradually as new accounts, enterprise systems and consumer services increasingly begin with passkeys.

Industry Outlook

The authentication market is entering an important transition.

The first phase was password adoption.

The second introduced multifactor authentication.

The next phase is moving toward phishing-resistant, cryptographic identity combined with continuous risk assessment.

Passkeys are likely to become a central component of this model.

However, the security industry will increasingly focus on the infrastructure surrounding them.

Endpoint security, credential recovery, device trust, identity providers, session management and malware detection will become increasingly important.

Recent research has demonstrated why this matters: attackers do not necessarily need to defeat cryptography if they can compromise the environment in which authentication takes place.

This could lead to a new generation of identity platforms that combine passkeys with behavioural analytics, hardware-backed security, continuous authentication and automated risk detection.

In other words, passwordless security may be only the beginning.

TechKip Perspective

The arrival of passkeys represents one of the most important changes in everyday cybersecurity because it removes a fundamental weakness from the authentication process: the reusable password.

But the recent security research is equally important because it prevents the industry from becoming complacent.

A passkey is not a magic shield.

It is a stronger foundation.

At TechKip, we believe the future of digital identity will depend on combining strong cryptographic authentication with secure devices, intelligent threat detection and carefully designed recovery systems.

The most important shift is not simply from passwords to passkeys.

It is from one-time authentication toward continuous digital trust.

As people use smartphones, laptops, browsers, wearables and connected services throughout the day, identity security will need to follow them across that ecosystem.

The companies that understand this distinction will be better prepared for the next generation of cyber threats.

Conclusion

Passkeys are entering the mainstream at precisely the moment when attackers are becoming more sophisticated.

That may sound contradictory, but it is actually a sign of the technology’s maturity.

The security industry is moving beyond the question of whether passkeys are better than passwords. The evidence increasingly points to yes: passkeys offer strong protection against many forms of credential phishing and eliminate the need for users to remember reusable passwords.

The more difficult question is how securely the entire passkey ecosystem is implemented.

Recent research shows that attackers can target devices, synchronisation systems, trusted sessions and supporting software without breaking the cryptographic foundation itself.

That is why businesses should adopt passkeys while continuing to invest in endpoint protection, identity monitoring, secure recovery and broader cybersecurity controls.

The password era may finally be coming to an end.

But the passwordless era will still require something just as important: trust in the devices and systems that protect our digital identities.

Frequently Asked Questions