Passkeys for Business: Are Passwords Finally Becoming Obsolete?

Why Passwords Are No Longer Enough

The Rise of Credential Theft

Stolen logins are now the most common way attackers get into a business. Verizon’s 2025 Data Breach Investigations Report found that credential abuse was the top initial access route, behind 22% of breaches.

Attackers no longer need to break in. They simply log in. That is why so many London businesses are moving to stronger sign-in methods, starting with MFA solutions for business and now passkeys.

Why Password-Based Security Is Failing

Passwords rely on people. And people are busy.

• Staff reuse the same password across several sites.
• Simple passwords are guessed or cracked in minutes.
• Strong passwords get written down or saved in insecure places.
• Even a perfect password can be typed into a fake login page.

The UK Government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses reported a breach or attack in the past year. Of those, 85% said phishing was involved. Phishing attacks are surging, and most are designed to steal a password.

How do cyber criminals exploit passwords?

Attackers buy stolen logins from earlier data breaches and try them on business accounts. They send phishing emails that lead to fake Microsoft 365 sign-in pages. They also use malware that quietly records what people type. All three methods depend on there being a password to steal.

The Cost of Weak Authentication

A single stolen password can lead to email fraud, data theft or ransomware. The cost is not just the clean-up. It is lost working time, damaged client trust and, in some cases, a report to the ICO.

There is a quieter cost too. Forgotten passwords and account lockouts are among the most common IT helpdesk requests. Every reset takes time away from real work.

What happens if a business keeps relying on passwords?

The risk does not stand still. Phishing kits are cheap, AI makes fake emails more convincing, and leaked passwords stay in circulation for years. A business that relies on passwords alone stays exposed to the most common type of attack.

Why are businesses moving away from passwords?

Password-related attacks remain one of the most common causes of cyber breaches. Passwords are also costly to manage, with constant resets and lockouts. Passwordless sign-in tackles both problems at once, which is why more businesses are making the switch.

Why Passkeys Matter Now

Passkeys replace the password with something far harder to steal. They are already built into Windows, macOS, iOS, Android, Microsoft 365 and Google Workspace.

For businesses reviewing their cyber security services in London, passkeys should now be part of the plan. Here is why the timing matters.

Why Passkeys Matter More Than Ever in 2026

Attackers Are Targeting Identities Instead of Devices

Cyber criminals have realised it is often easier to steal a login than to hack a network.

Once they control a genuine user account, they can move through Microsoft 365, email, file storage and business apps. Because they are signing in as a real person, their activity can look normal and is harder to spot than a traditional attack.

AI Is Making Phishing Attacks Harder to Spot

Generative AI lets attackers create convincing emails, login pages and impersonation attempts at scale.

Many phishing emails now have perfect spelling, correct branding and believable context. The old advice to look for poor grammar no longer works, which leaves password-based sign-in more exposed than ever.

Security Frameworks Are Moving Towards Passwordless Authentication

In April 2026, the UK’s National Cyber Security Centre (NCSC) said it now recommends passkeys wherever a service supports them.

Microsoft, Google and the FIDO Alliance also publicly back the move to phishing-resistant sign-in. For many organisations, passkeys are the logical next step beyond traditional MFA.

What Are Passkeys and How Do They Work?

Understanding Passwordless Authentication

Passkeys replace traditional passwords with secure, device-based sign-in. Logins become faster and far more resistant to phishing.

A passkey is a digital key stored on your device. It is made of two linked parts:

• A private key, which never leaves your phone, laptop or security key.
• A public key, which is stored by the website or service.

When you sign in, your device proves it holds the private key. Nothing secret is sent across the internet. There is no password to type, remember or steal.

Passkeys vs Passwords

The difference is simple. A password is something you know, so it can be shared, guessed or tricked out of you. A passkey is something you have, unlocked by something you are or a PIN.

• Passwords can be reused, leaked in a data breach or entered on a fake site.
• Passkeys are unique to each service and only work on the genuine website they were created for.

Are passkeys more secure than passwords?

Yes. Passkeys are designed to prevent credential theft. No password is sent over the internet or stored on a server where attackers could steal it. Passkeys are also resistant to phishing, password reuse and database leaks. Because each passkey is tied to the real website’s address, your device will not use it on a lookalike site. That removes the most common way accounts are taken over.

Can passkeys be hacked?

No sign-in method is completely immune to attack. But passkeys remove many of the techniques cyber criminals rely on most, including password theft, password reuse and phishing. Attackers are left with harder routes, such as stealing a device or targeting weak recovery processes.

How Biometrics Improve Security

Most people unlock a passkey with a fingerprint, face scan or device PIN. This is the same action they already use to unlock their phone.

Your fingerprint or face data stays on your device. It is never sent to Microsoft, Google or any other service. The biometric simply confirms it is really you before the device uses the passkey.

What happens if I lose my phone?

You do not lose access for good. Synced passkeys are backed up through your Apple, Google or Microsoft account and restored on a new device. Businesses should also have a documented recovery process. That should include identity checks, backup sign-in methods and secure device replacement, so a lost device is a short delay, not a crisis.

Passkeys vs Passwords vs Traditional MFA

How the Three Sign-In Methods Compare

Here is how the three most common approaches stack up for a typical business.

Traditional MFA is only partly phishing-resistant. Codes and push approvals can still be captured by sophisticated fake login pages, or approved by a tired user. Passkeys close that gap.

Are passkeys better than MFA?

Passkeys are often seen as the next step in the evolution of multi-factor authentication. They combine possession of a trusted device with a fingerprint, face scan or PIN. The result is phishing-resistant, easier for staff and much harder for attackers to get around.

Do passkeys replace multi-factor authentication?

In many cases, a passkey counts as a strong, phishing-resistant form of multi-factor authentication on its own. It combines something you have (your device) with something you are or know (a fingerprint, face or PIN). If you want the background, read what is MFA.

Some businesses still add extra controls, depending on their risk profile. For example, Conditional Access can require a managed device as well as a passkey for sensitive systems.

The Benefits of Passkeys for UK Businesses

What are the benefits of passkeys for businesses?

The main benefits are stronger security, fewer password resets, lower helpdesk costs and a simpler sign-in for staff. Each of these is covered below.

Reduced Phishing Risk

Phishing works by tricking someone into entering their login on a fake page. With a passkey, there is nothing to enter. Even if a member of staff clicks a convincing link, their passkey will not work on the attacker’s site.

This does not make staff awareness less important. Attackers still try other tricks, such as fake invoices and impersonation calls. Cyber security training for employees remains essential, alongside our guide to the 12 types of social engineering attacks.

Can passkeys prevent phishing attacks?

Passkeys are phishing-resistant because each one is linked to a specific website or service. Staff cannot accidentally hand their login to a fake page, because the passkey will not work there. However, attackers can still target weak recovery processes, so account recovery needs the same care as sign-in.

Simplified User Experience

Staff no longer need to remember complex passwords or change them every few months. Signing in takes a glance or a touch.

The FIDO Alliance, the industry body behind passkeys, reported in 2025 that passkey sign-ins succeed 93% of the time. That is more than double the success rate of other methods.

Lower IT Support Costs

Fewer passwords means fewer password resets. The same FIDO Alliance research found service providers saw up to 81% fewer login-related helpdesk incidents after adopting passkeys.

For a growing business, that means less time lost to lockouts and more time for your IT team, or your 24/7 IT helpdesk, to focus on work that adds value.

How do passkeys reduce IT support tickets?

Staff no longer need to remember, reset or manage complex passwords. That removes some of the most common access problems, such as forgotten passwords, expired passwords and accounts locked after too many failed attempts.

How much do passkeys cost?

Passkey support is built into Microsoft 365 and Google Workspace, so there is often no extra licence to buy. The main cost is the time to plan, configure and support the rollout. Hardware security keys, if you choose them for admin accounts, are an extra purchase.

Are passkeys suitable for small businesses?

Yes. Small businesses get stronger security without the cost and complexity of traditional identity management systems. Because passkeys use devices staff already have, a small team can often adopt them quickly.

Which businesses benefit most from passkeys?

Passkeys are particularly valuable for organisations that:

• Use Microsoft 365 extensively.
• Handle sensitive customer data.
• Need Cyber Essentials certification.
• Have remote or hybrid workforces.
• Deal with frequent password reset requests.

Are passkeys suitable for regulated industries?

Yes. Financial services firms, insurers, legal practices and healthcare providers can all use passkeys as part of a wider security strategy. Because passkeys resist phishing, they help reduce one of the most common causes of account compromise. If your firm is regulated, our IT support for financial services covers how this fits your wider obligations.

How Microsoft and Google Are Driving Passkey Adoption

Microsoft Entra ID and Passkeys

Microsoft has made passkeys a core part of Microsoft 365 sign-in. In 2026, passkey profiles in Microsoft Entra ID became generally available. This lets administrators decide which types of passkey staff can use:

• Device-bound passkeys, stored on one device or a hardware security key.
• Synced passkeys, stored in Microsoft Authenticator or a password manager and available across a user’s devices.

Microsoft has also said it will turn passkey profiles on automatically in tenants that do not configure them. That makes it worth reviewing your settings now, rather than letting defaults decide for you. Our Microsoft services for London businesses include reviewing and configuring these options. You can also read our round-up of Microsoft 365 August 2026 updates.

Are passkeys supported by Microsoft 365?

Yes. Microsoft supports passkeys through Microsoft Entra ID, the identity service behind Microsoft 365. Staff can store passkeys in Microsoft Authenticator, on a security key or, where allowed, in a supported password manager.

What does this mean for Microsoft 365 users?

If your business uses Microsoft 365, passkeys are already available to you. With Microsoft enabling passkey profiles automatically, now is a good time to check your settings match the way you want staff to sign in.

Google Workspace Passkey Integration

Google Workspace also supports passkeys. Administrators can allow users to skip their password at sign-in and use a passkey instead. Staff can sign in with their phone, a security key or their computer’s screen lock.

Turning this on does not delete existing passwords straight away. That gives businesses time to move staff across gradually.

Industry Adoption Trends

Passkeys are no longer niche. The FIDO Alliance estimated in 2025 that:

• Around 3 billion passkeys are in use.
• More than 15 billion online accounts support them.
• Consumer awareness rose from 39% to 57% in two years.

Banks, retailers and government services are all adding passkey sign-in. Your staff are likely already using passkeys in their personal lives.

Do passkeys help with Cyber Essentials?

As we explain in why Cyber Essentials is getting harder to pass in 2026, missing MFA on cloud services is now an automatic fail. Passkeys are a strong way to meet that expectation, and the latest question set reflects the shift towards passwordless sign-in. Read more about the Cyber Essentials changes every UK business needs to know, or see our Cyber Essentials certification London service.

How to Implement Passkeys in Your Organisation

Should my business switch to passkeys now?

Most businesses do not need to wait. If you already use Microsoft 365 or Google Workspace, passkey support is available today. The main thing is to plan the rollout properly and make sure your recovery process is secure.

How can businesses start implementing passkeys?

Most organisations start by reviewing their identity platform, their authentication policies and how ready their staff are. The first practical step is usually an audit of how people sign in today. The steps below set out a typical rollout.

Step 1: Review Your Current Sign-In Methods

Start with an audit. Find out which systems your staff log in to and how. Look for accounts still protected by a password alone, and any shared accounts that need a different approach.

Step 2: Choose the Right Type of Passkey

Decide where passkeys should live. Synced passkeys are easiest for most staff. Device-bound passkeys or hardware security keys suit admin accounts and high-risk roles, such as finance teams.

Step 3: Start With a Pilot Group

Roll passkeys out to a small group first. Your IT team and a few willing staff are ideal. Their feedback will help you write clear instructions before a wider launch.

Step 4: Plan for Lost Devices and Recovery

Set up backup sign-in methods and a secure recovery process before anyone needs it. Recovery is where attackers will try next, so it must not fall back to a weak password or an easy phone call.

Step 5: Remove Passwords Where You Can

Once staff are comfortable, tighten your policies. Make passkeys or other phishing-resistant methods the default, and reduce how often passwords can be used. Pair this with dark web monitoring for business to spot any old credentials that have leaked.

How long does it take to roll out passkeys?

It depends on the size of your business and the systems you use. A small team on Microsoft 365 or Google Workspace can often move quickly once settings are reviewed. Larger organisations with older line-of-business apps should plan a phased rollout.

Do passkeys replace password managers?

Not entirely. Many businesses still use a password manager for older systems that do not yet support passkeys. Some password managers can now store passkeys too, which helps during the transition.

What if some of our systems don’t support passkeys?

That is common. Keep strong, unique passwords stored in a business password manager, and protect those systems with MFA. Our guide Are Your Passwords Secure, 2026 Edition covers the basics. A zero trust security approach also helps limit the damage if any single login is compromised.

What are the most common passkey rollout mistakes?

The most common mistakes are rolling out to everyone at once, forgetting about account recovery, and leaving old passwords active indefinitely. Another is not explaining the change to staff, which leads to confusion and extra support calls.

How can an IT support provider help with passkeys?

A provider can review your Microsoft 365 or Google Workspace settings, plan the rollout, configure recovery options and support staff through the change. That avoids lockouts and keeps the project moving alongside your day-to-day work.

Talk to Speedster IT About Moving to Passkeys

Passkeys are one of the simplest ways to cut phishing risk and reduce password headaches. If you would like help reviewing your sign-in settings and planning a safe rollout across Microsoft 365 or Google Workspace, our team can help.

Call us on 0204 511 9111, email hello@speedster-it.com or get in touch online to book a passkey readiness review.

Louise

With over 15 years at Speedster IT, I’ve built a career around helping businesses navigate the evolving world of technology. I publish all the content for the IT Support London Blog and Cyber Security Blog, where I share practical insights on infrastructure upgrades, cybersecurity trends, and smart IT strategies for growing companies.