Digital identity reform is not simply a more convenient login screen. It changes how organisations manage account recovery, workforce access and the security of critical business systems.
The password problem is also an operations problem
Password-based access creates a recurring burden for employees, customers and IT teams. Forgotten credentials require support; reused secrets create exposure when a separate service is compromised; and attackers can impersonate legitimate sign-in pages. The response is increasingly focused on authentication that can resist phishing rather than asking people to recognise every deceptive message.
The National Institute of Standards and Technology (NIST) updated its Digital Identity Guidelines in 2025. Its authentication guidance describes requirements at different assurance levels and gives particular attention to phishing-resistant methods. The guidance is written for federal digital identity systems, but its definitions and risk-management approach provide a useful reference for enterprise technology teams. [Source: NIST]
What makes a passkey different
Passkeys use public-key cryptography. In a typical implementation, a service stores a public key while the private key is held by an authenticator linked to a device or account. A successful login demonstrates possession of the corresponding private key without transmitting a reusable password to the website. Authentication is also bound to the legitimate service, helping defeat common lookalike-site phishing techniques.
That does not make every passkey deployment equally secure. Organisations need to understand whether credentials can be synchronised between devices, how authenticators are protected, and what happens when someone loses access to their devices. NIST distinguishes among authenticator characteristics and assurance requirements, including provisions for syncable authenticators. [Source: NISTWEB]
The difficult questions begin after enrolment
The value of stronger sign-in can be lost if recovery and help-desk procedures are weaker than the normal login route. For example, an attacker unable to use a phishing page may still try to persuade support staff to reset an account. Enterprises therefore need controlled enrolment, identity verification for recovery, clear revocation procedures and records of administrative changes.
High-impact accounts need additional attention. Finance administrators, payroll approvers, cloud infrastructure operators and users with access to sensitive customer records may warrant different authentication policies from occasional visitors to a public website. NIST makes implementation resources available alongside its guidelines, including conformance material and reference architectures. [Source: NISTRE]
Security standards are moving, but context still matters
A 2026 security memorandum from the US Centers for Medicare & Medicaid Services lists phishing-resistant public-key authenticators, including FIDO2 and passkeys, among its preferred mechanisms for certain access scenarios. It also explains that one-time-password and out-of-band methods are not phishing-resistant. This is an example of public-sector policy, not a universal rule imposed on all private companies. [Source: CMS]
For international companies, a responsible rollout also includes accessibility, staff training, device ownership, privacy, vendor interoperability and country-specific obligations. Shared devices, contractors and customers without compatible smartphones require a workable path that does not undermine security.
From deployment to governance
Management should evaluate digital identity as an ongoing service rather than a one-off technology procurement. Useful measures include the proportion of high-risk accounts using phishing-resistant authentication, the frequency of recovery requests, time to revoke compromised access and the number of exceptions still relying on weaker methods.
Passkeys can reduce some common authentication vulnerabilities, but they cannot remove endpoint compromise, insider misuse or poor authorisation design. Their practical value depends on resilient recovery processes, effective access controls and consistent oversight. The larger transition is from treating passwords as an individual responsibility to treating identity assurance as an organisational control.
References
1. NIST, Digital Identity Guidelines: Authentication and Authenticator Management (SP 800-63B-4), 2025
2. NIST, SP 800-63B-4 Web Edition: Authenticator and Verifier Requirements
3. NIST, Digital Identity Guidelines Implementation Resources
4. US Centers for Medicare & Medicaid Services, Phishing-Resistant Access Memorandum, 2026