The problem
The password is the attacker’s best friend
Passwords have two fundamental problems: people choose bad ones, and even good ones can be stolen. Phishing pages that look exactly like your login, credentials leaked from other services and plain interception have made the password the weakest link in almost every organisation.
Classic MFA helps but does not close the gap. Modern phishing toolkits sit between the user and the real login page and relay both the password and the one-time code in real time. And authenticator apps can be worn down: send enough prompts, and a certain share of users will tap approve just to make it stop.
The solution
Passkeys: a key that only fits your lock
A passkey is a cryptographic key pair instead of a password. The private part lives in the user’s phone, PC or security key and never leaves it; the user unlocks it locally with a fingerprint, their face or a PIN. The technology behind it is called FIDO2/WebAuthn and is standard in Windows, macOS, iOS and Android.
The crucial point is that a passkey is bound to the domain it was created for. A fake login page can look identical to yours – but the passkey simply will not answer it. Phishing of logins does not just get harder, it becomes technically impossible. There is no code the user can be tricked into revealing.
The gains
What you get out of it
- Phishing resistance: the category of attack that starts most security incidents no longer works against logins.
- Nothing to leak: the server stores only the public key – a breach at your end or a vendor’s reveals no usable credentials.
- Faster logins: a fingerprint is both stronger and faster than a password plus a one-time code – users discover that the secure choice is also the easy one.
- Fewer helpdesk tickets: forgotten passwords are one of the biggest single items in any helpdesk – they disappear along with the passwords.
- Demonstrable strength: phishing-resistant MFA is the kind of control that supervisors and insurers increasingly ask about directly.
Where should you start?
Where a stolen login does the most damage: administrators, remote access and senior management. Those groups are small enough for a quick rollout and exposed enough that the gain is noticeable from day one. Security keys or the platform’s built-in passkeys – both work.
The broader rollout can happen in stages: let passkeys coexist with the current login and move users group by group. Most identity platforms, including Entra ID, support it today without extra licenses – often the biggest piece of work is the decision.
Ready to retire the password?
We help you plan phishing-resistant MFA – from the most exposed accounts to the entire organisation.
