Why passkeys work for organisations

Every organisation runs on logins and nearly every organisation still runs on a login method that is leaky at best: Passwords. We think passkeys are the way out in general, but the benefit is even bigger for organisations than for consumers.

What’s wrong with good ol’ passwords?

Story time! Ever since I worked one of my first jobs during high school in a bike shop I’ve worked with people handling their passwords, well, poorly. From the sticky note on the monitor (yes, really) to the “123456” pin for the bike rental system to the 90 day password rotation policy that means you update your password from “MyBossSucks!1” to “MyBossSucks!2” (not me, of course, my boss is great) and be done for a couple months. And honestly, I don’t blame them. A quick look at my password manager shows me I have 250+ passwords saved accross as many services. Try to keep track of those if your boss won’t let you use a password manager (bad sign, but not the point of this post). There are so many people that have workarounds for their passwords: password reuse, simple passwords, tiny alterations for multiple services, the list is endless.

And we haven’t even talked about the organisational side of things. People come back from holidays forgetting their passwords all the time, taking precious time of IT helpdesks to get them a password reset. The password policies that need retention that are uneffective and maybe even actively harmful. The UK’s National Cyber Security Centre is refreshingly blunt: forcing regular password expiry “carries no real benefits”, because people pick minor variations of their old password and stolen passwords tend to get used immediately anyway. Their guidance is to change a password only when you know or suspect it has been compromised.

And the biggest problem of all? People can be convinced to hand over their password to people who are looking to do harm. ENISA’s Threat Landscape 2025 found that social engineering remains the primary entry point for attackers, with phishing and closely related methods accounting for around 60% of observed cases. Exploiting an actual software vulnerability came second at 21.3%. Attackers are usually not breaking your software with crazy exploits. They are asking your colleagues nicely to hand over their login credentials.

Over here in The Netherlands a large telephone company found out about that in February 2026. Attackers phished login details from customer service employees, then called those employees pretending to be the IT department and talked them into approving the suspicious login. Roughly 6.2 million current and former customers were warned their data may have been taken.

What are passkeys, conceptually?

Passkeys are something completely different from passwords, built on the same maths that has kept traffic on the internet secure for decades: public key cryptography.

Instead of a shared secret that you and the service both need to know, you get a key pair. Your device keeps the private half. The service only ever gets the public half. According to the WebAuthn specification: the credential private key “is bound to a particular authenticator” and “is expected to never be exposed to any other party”.

This means there is no secret password sitting in a database waiting to be stolen, because the thing the service stores is public by design. An attacker who walks off with the user table walks off with a list of public keys. A username or e-mail address could still be exposed though. It’s not a silver bullet.

A passkey also doesn’t tie you to one big tech company’s standard. It’s a credential under two open standards that merge together: WebAuthn, which is what your browser speaks, and CTAP from the FIDO Alliance, which is how your browser talks to whatever is holding the key, be that the secure chip in your computer, a Yubi key or your password manager.

Europe’s regulators have noticed. When ENISA published its NIS2 technical implementation guidance in June 2025, it ranked authentication methods from strongest to weakest. The top tier is described as “no shared secrets, not vulnerable to attacker-in-the-middle” with a “protected cryptographic private key that can be securely registered to a domain, in accordance with Fast Identity Online (FIDO) and W3C WebAuthn standards”. That description sounds awfully familiar, doesn’t it?.

How do passkeys work?

A key is tied to your device or your password manager. You prove you have the device (factor 1), you unlock it with your face, fingerprint or PIN (factor 2), and voila: you have an excellent multi-factor authentication (MFA) experience without anyone having to think about it.

So, how does it work? When you register, your device generates a key pair and sends the public key to the service. When you log in, the service sends over a challenge, your device signs that challenge with the private key, and the service checks the signature against the public key it already has. The challenge is single use and, per the spec, “must be generated by the Relying Party server” and “must be unpredictable to prevent replay attacks”. Nothing reusable ever crosses the wire. Capturing an old login is useless, because yesterday’s challenge is already gone.

This counting as MFA is not just a technicality. Your device tells the service two separate things: that a person has access to that device and that it checked who that person was. The receiving service can insist on the second one, so you don’t have to hope your colleagues are really using their fingerprint. It’s part of what gets signed.

Now, why can’t passkeys be phished? A passkey is locked to one website, and that’s in the standard: a passkey can only be accessed by origins belonging to the site it was made for. Your browser knows which site is asking. Land on not-really-yourcompany-login.com and there is no key to hand over. Nobody can talk you into reading it out over the phone either, because there is nothing to read out.

Which is also where a passkey is different from an Authenticator app asking you to click “Yes it’s me!“. ENISA puts push notifications under “last resort” MFA, far below FIDO and WebAuthn.

Why this fits so well for organisations

So, what could passkeys bring your organisation?

For the people who work there, ease of use mainly. Logging in becomes what unlocking your phone already is: look at it, or touch the sensor, and you’re in. Nothing to remember, nothing to invent, nothing to type. No email on Monday morning telling you your password expires on Friday and no rules about which special characters count. Your people are usually the weakest link in software security, so help them do better by making the better thing easy.

For the organisation, those are the same wins seen from the other side. There is no password policy to write and enforce, because there is no password to have a policy about. No weak passwords, no reused passwords, no sticky notes on monitors. And the big one: No more phishing for your employee’s credentials to breach your systems.

It’s not all unicorns and rainbows though. Passkeys are not the silver bullet to solve all security incidents. There’s also a real risk of losing them and losing your access with them. Contingency plans need to be in place. That’s why we believe they’re a great fit for organisations, while they won’t be a good fit for just any individual.

At Permiso, we’re all in on passkeys. Because you know what? Passwords s*ck.