<p>CISOs know that the human element can be the weakest link in an enterprise’s cybersecurity defenses, often surfacing when end users create weak passwords that threat actors easily crack. Seeking a stronger alternative, security teams are increasingly turning to passkeys.</p>
<p>Unlike passwords, which end users create, passkeys are digitally generated cryptographic credentials that work as part of an identity and access management (IAM) strategy. <a href=”https://www.techtarget.com/whatis/definition/passkey”>Passkeys</a> use biometrics and are stored on a device — such as a phone — or as a hardware token. Passkeys don’t communicate through a server; they are validated through authentication services.</p>
<section class=”section main-article-chapter” data-menu-title=”Passwords vs. passkeys: A safer option”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>Passwords vs. passkeys: A safer option</h2>
<p>Beyond providing an alternative to weak passwords, passkeys that use biometrics or device-based cryptographic keys are significantly harder to capture through <a href=”https://www.techtarget.com/searchsecurity/tip/How-to-avoid-and-prevent-social-engineering-attacks”>social engineering tactics</a> such as phishing.</p>
<p>Offering options such as fingerprint access and device PINs, passkeys streamline logins and avoid the extra steps required by many security tools. Even as they enhance access security, passkeys keep the login process simple. Users don’t have to remember complicated passwords or navigate constant password changes.</p>
<p>Through the use of digital authentication, passkeys are an effective option to eliminate the inherent weaknesses — in terms of both security and ease of use — of passwords.</p>
<blockquote class=”main-article-pullquote”>
<div class=”main-article-pullquote-inner”>
<figure>
Through the use of digital authentication, passkeys are an effective option to eliminate the inherent weaknesses — in terms of both security and ease of use — of passwords.
</figure>
<i class=”icon” data-icon=”z”></i>
</div>
</blockquote>
</section>
<section class=”section main-article-chapter” data-menu-title=”The rise of enterprise passkeys”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>The rise of enterprise passkeys</h2>
<p>A <a target=”_blank” href=”https://fidoalliance.org/wp-content/uploads/2025/02/The-State-of-Passkey-Deployment-in-the-Enterprise-in-the-US-and-UK-FIDO-Alliance.pdf” rel=”noopener”>FIDO Alliance survey</a> of 400 security decision-makers found that 87% of companies are implementing passkeys.</p>
<p>One driving force behind the transition is the increased emphasis on a <a href=”https://www.techtarget.com/searchsecurity/feature/How-to-implement-zero-trust-security-from-people-who-did-it”>zero-trust security approach</a>, in which entities are denied access to enterprise resources until authenticated and verified.</p>
<p>Another reason passkeys are becoming more popular is that enterprises are under constant pressure to meet regulatory requirements and strengthen digital identity security. Passkeys provide stringent access controls and the audit trails necessary to prove compliance.</p>
<p>Most advanced identity management systems work with passkey technology, including mobile authenticators and biometric scanners. This provides another verification point, vital for organizations using mobile and cloud platforms, while requiring stronger controls than conventional passwords offer. Passkeys also often work with MFA that requires, at minimum, two forms of authentication to access enterprise resources.</p>
</section>
<section class=”section main-article-chapter” data-menu-title=”Mapping a successful passkey deployment”>
<h2 class=”section-title”><i class=”icon” data-icon=”1″></i>Mapping a successful passkey deployment</h2>
<p>Security decision-makers must choose whether to deploy enterprise or consumer passkeys, or both.</p>
<p><b>Enterprise passkeys</b> are typically used for internal employees, contractors and partners who need access to confidential or high-value resources. It is crucial that enterprise passkeys work with existing infrastructure and policies, including single sign-on, management tools, corporate devices and policy enforcement.</p>
<p><b>Consumer passkeys</b> are primarily for external users, including customers and subscribers. Internal end users might also need consumer passkeys to access external digital platforms. Ease-of-use is a major consideration during login and password resets, but the emphasis should be on interoperability and priv
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: