By Carlos DaSilva, Product Strategy Advisor, Unibeam
Recently, Microsoft and other organizations have begun making passkeys the default login method for consumers and enterprises, reflecting a wider industry trend to improve security while reducing user friction. However, as authentication methods evolve, passkeys alone don’t mitigate all security risks and shouldn’t be mistaken for a complete identity security strategy.
The challenge for industry leaders now is no longer simply eliminating passwords. It’s verifying that every method used to establish or restore trust meets the same security standard as the primary login experience.
Passkeys Don’t Eliminate Weak Links
As organizations steadily adopt passkeys, it’s a promising signal that they are actively reassessing the growing threat landscape and moving away from high-risk, legacy login methods like SMS one-time passwords (OTP), which are highly susceptible to phishing, SIM-swap attacks and other forms of account takeover. But even if an organization eliminates passwords from the primary login experience, it can reintroduce risk through the fallback and recovery methods users rely on when they need to regain access to their accounts.
Let’s look at a common problem. A company offers passkeys to its users so they don’t have to re-enter passwords, but they don’t make them mandatory. More often, they’re offered as a convenient solution alongside weaker authentication methods.
Fraudsters don’t need to brute-force their way in when they can simply exploit loopholes. Once passkeys become an option for primary login, attackers won’t always target them. Instead, they’ll look for the weaker alternatives. With organizations deploying passkeys more broadly, it’s vital for security teams to evaluate every possible authentication path – not just the one protected by a passkey.
Security Doesn’t Stop at Login
While passkeys significantly help prevent account takeover, they still have limitations. Passkey synchronization across devices improves usability but can also expand the attack surface. Likewise, sharing passkeys with trusted family or friends creates another avenue for abuse that organizations must consider.
Effective fraud and account takeover prevention requires securing both primary authentication methods and the recovery options that support them. Passkeys are designed primarily for sign-in, leaving organizations to manage the rest of the identity lifecycle. This includes account recovery, re-enrollment and authorizing high-risk business transactions with alternative and methods that are more vulnerable to cyberattacks.
For example, operating systems may require passkey re-enrollment after changes to device security settings. Organizations are then forced to choose between a highly secure but potentially painful re-enrollment experience for their customers, or a simpler recovery process through authentication methods that can introduce security weaknesses.
The authentication challenge for organizations doesn’t end once a user logs in – it continues throughout the entire identity lifecycle.
Anchoring Trust in Hardware
As the threat landscape evolves, security leaders must think beyond sign-in and focus on upholding trust across the full identity lifecycle. That means anchoring identity to authentication methods that provide a stronger foundation of trust than passkeys alone. For example, hardware-based methods like SIM-based authentication cryptographically root a user’s identity to the SIM card in their mobile device. It’s resistant to synchronization, difficult to spoof and is built around a single source of trust that works seamlessly across the entire authentication lifecycle, not just login.
Hardware-based authentication doesn’t need to replace passkeys completely, either. Organizations can use both authentication methods to proactively address potential security gaps. A mobile SIM-based solution that securely stores a passkey, or an operating system passkey used alongside SIM-based authentication, can serve as a strong primary or fallback authentication factor while adding the assurance of hardware-based authentication. By combining the two methods, organizations can strengthen identity verification in primary login, account recovery, re-enrollment and high-risk business interactions, ultimately minimizing exploitable gaps – and all without having to choose between a smoother user experience and strong security.
Staying ahead of attackers who continually adapt to each new line of defense added to the authentication process requires security leaders to rethink security design and implementation just as proactively, if not more so. Looking ahead, they must consider a larger question: are they securing a specific authentication event, or securing trust itself?
##
ABOUT THE AUTHOR
Carlos DaSilva is the Product Strategy Advisor at Unibeam. With 25 years of experience in international telecommunications, his expertise includes digital authentication, SIM-based solutions, the economics of international IP transit, voice business, IPX and HDVC.
