NewsPublished 30 Oct 2026

Passkeys Are Better Than Passwords. But They Are Not Enough.

Source SecurityWeek

Description

This analysis discusses the security implications of passkeys as a replacement for passwords. Passkeys improve authentication security by using cryptographic credentials that are phishing-resistant and not reusable, reducing risks like credential theft and phishing. However, passkeys do not eliminate broader identity risks such as compromised account enrollment, device changes, recovery processes, or session hijacking. Attackers may target these surrounding areas rather than the authenticator itself. Continuous identity threat detection is necessary to evaluate trust beyond the moment of authentication, addressing risks throughout the identity lifecycle.

Impact

Passkeys reduce risks related to password theft, phishing, credential stuffing, and MFA fatigue by eliminating reusable secrets and binding authentication to legitimate services. However, they do not mitigate risks from compromised account enrollment, device changes, fallback recovery methods, or session hijacking. Attackers may exploit these gaps to bypass strong authentication. Without continuous identity risk evaluation, organizations may trust compromised identities post-authentication, potentially leading to unauthorized access or abuse.

Defensive guidance

Organizations should implement passkeys to strengthen authentication but must also deploy continuous identity threat detection to evaluate trust beyond authentication events. Secure enrollment and recovery processes are critical to prevent attackers from bypassing passkeys via weaker fallback methods. Identity risk should be continuously assessed using device signals, behavioral analytics, and contextual information to detect and respond to suspicious activity. This layered approach addresses the broader identity security challenge beyond authentication alone.

Summary

Passkeys replace passwords with cryptographic credentials stored on user devices, providing strong phishing resistance and eliminating reusable secrets. While this significantly improves authentication security, it does not address identity risks such as compromised account creation, device loss or replacement, recovery mechanisms, or session hijacking. Attackers adapt by targeting these peripheral vulnerabilities rather than the passkey authenticator. Therefore, organizations must complement passkeys with continuous identity threat detection to assess ongoing trustworthiness of authenticated identities and respond to anomalous behavior or risk changes.

References

securityweek.com/passkeys-are-better-than-passwords-but-they-are-not-enough/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Oct 2026, 14:17 UTC

Technical details

References

Community reviews