For decades, passwords have been one of cybersecurity’s most persistent weaknesses. Users forget them, reuse them, share them, and surrender them to convincing phishing sites. Attackers steal credentials, automate credential stuffing, and increasingly use artificial intelligence to make social engineering more effective.
What are passkeys?
Passkeys promise to eliminate much of this problem.
Built on public-key cryptography, passkeys replace shared secrets with cryptographic credentials. There is no password for an attacker to steal, intercept through phishing, or reuse against another service. Properly implemented passkeys are also phishing-resistant because authentication is bound to the legitimate service.
That represents a significant improvement over passwords and many traditional forms of multi-factor authentication (MFA). But it does not answer a more fundamental question: Just because someone successfully authenticated, should we continue to trust that identity?
Passkeys strengthen authentication. They do not eliminate identity risk.
What Passkeys Get Right
Traditional authentication frequently relies on passwords combined with one-time passcodes, SMS messages, or push notifications. While stronger than passwords alone, these methods remain vulnerable to phishing, adversary-in-the-middle attacks, MFA fatigue, SIM swapping, and social engineering.
Passkeys fundamentally change that model. Instead of presenting a reusable secret, the user’s device holds a private cryptographic key while the service retains the corresponding public key. The private key is not transmitted during authentication.
This provides meaningful protection against phishing, credential stuffing, password database theft, and other attacks built around stealing reusable credentials. Passkeys can also improve usability because users no longer need to remember complex passwords or repeatedly retrieve authentication codes.
Organizations should welcome that transition. The mistake would be assuming that stronger authentication solves the broader identity security problem though.
Authentication Is Not Identity
When passkey authentication succeeds, the system has strong cryptographic evidence that a credential associated with an account completed the authentication process.
But was the account legitimately established? Has the underlying identity been compromised? Is the device trustworthy? Is an attacker operating through an authenticated session?
A perfectly functioning authentication mechanism cannot compensate for an identity that should never have been trusted.
If an attacker establishes or takes control of an account before a passkey is bound to it, the organization may subsequently perform highly secure authentication of the wrong person. The stronger the authenticator becomes, the more important the integrity of enrollment becomes.
What Happens When the Device Changes?
Legitimate users also do not always authenticate from the same device. Phones are lost, stolen, damaged, or replaced. Employees receive new laptops. Consumers switch technology ecosystems.
Passkey synchronization addresses many of these scenarios by making credentials available across supported devices. But organizations still need to accommodate legitimate users who arrive without access to the expected passkey.
At that point, the challenge shifts from authentication to recovery and re-establishing trust. How does the organization determine whether someone requesting access from an unfamiliar device is the legitimate account owner?
If the fallback relies on a password, SMS code, email link, knowledge-based question, or help desk process, attackers may target that weaker recovery path.
The passkey has not been compromised. The attacker has gone around it.
Organizations therefore need a secure way to re-establish identity trust before associating a new authenticator or device with an existing account.
Authentication Is Only One Moment
Another gap emerges after authentication. Many identity architectures effectively operate according to a simple sequence: Authenticate, grant access, and trust the resulting session.
Modern identity-based attacks do not necessarily stop at the login screen. Attackers can hijack authenticated sessions, compromise trusted devices, abuse privileges, manipulate account attributes, or conduct anomalous transactions. In these situations, the authentication mechanism may have worked exactly as designed.
The question cannot simply be, “Did this user authenticate successfully?” It must also be, “Do we still have sufficient evidence to trust this identity and its activity?”
Layer Identity Threat Detection on Top
This is where identity threat detection complements passkeys.
Instead of treating successful authentication as a permanent declaration of trust, organizations can continuously evaluate identity risk. Device characteristics, identity attributes, behavioral anomalies, network intelligence, account changes, transaction context, and threat indicators can help determine whether an identity remains trustworthy.
This does not require adding friction to every interaction. A risk-based model can allow legitimate users to proceed normally while escalating controls when risk changes.
A known user authenticating from an established device and behaving normally may require no additional intervention. The same account attempting recovery from an unfamiliar device, changing critical account attributes, or conducting anomalous activity could trigger additional identity verification.
The model changes from authenticate once and trust thereafter to establish trust, continuously evaluate risk, and respond when trust changes.
The Future of Identity Security Must Go Beyond Authentication
Passkeys and identity threat detection address distinct parts of the identity attack surface.
Passkeys reduce risks associated with passwords, credential theft, credential stuffing, and phishing. Identity threat detection addresses risks surrounding authentication, including enrollment, recovery, device changes, session compromise, and anomalous activity.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.
That does not mean passkeys failed. It means they succeeded in making one part of the attack surface harder.
Passkeys answer an important question: Does this user possess a legitimate credential required to authenticate?
Identity threat detection addresses the question that matters throughout the identity lifecycle: Should we still trust this identity?
Organizations need to answer both.
Related: Phishing Toolkit Uses Passkeys to Maintain Access After Password Resets
Related: Google Now Syncing Passkeys Across Desktop, Android Devices
