Passkeys gain ground as password risks grow

Passkeys are gaining attention as organizations reconsider passwords amid automated cyberattacks and the rise of autonomous AI systems. Alex Laurie, GTM CTO at Ping Identity, argues that static passwords are increasingly poorly suited to these threats. He points to the UK National Cyber Security Centre (NCSC), which described the shift as “overhauling decades of security practice.”

Laurie says AI tools can help criminals carry out credential-stuffing attacks and realistic phishing campaigns at machine speed. Yet adoption of passkeys and other password alternatives depends partly on organizations’ identity and access management (IAM) systems: only 30% of businesses with less mature or no IAM strategy are embracing password alternatives.

Passkeys use cryptographic authentication. Their private keys remain on a user’s device rather than being shared with a central server or application, and passkeys are tied to a verified domain. Laurie says these properties can help resist phishing and avoid a central password database. He also cites a trust gap: only 17% of the British public fully trusts organizations that manage their identity data.

Autonomous AI agents create a further challenge if they rely on human credentials, which could expose sensitive data if misused or compromised. Laurie argues that agents should have distinct identities and task-specific, time-bound permissions.

Legacy systems can make password removal difficult. Laurie says low-code or no-code identity platforms can help organizations introduce passkeys or biometric prompts progressively without replacing entire systems or disrupting user workflows. Google and Amazon have positioned passkeys as default authentication options, he says. The article is an opinion piece produced for TechRadar Pro Perspectives; its views are the author’s and are not necessarily those of TechRadar Pro or Future plc.