Why we're recommending passkeys over passwords and MFA

"All traditional MFA methods – including passwords combined with SMS codes, email codes, time-based One Time Passwords generated by apps or physical tokens, push approvals – are inherently phishable."

That is the assessment of the UK's National Cyber Security Centre (NCSC).

Passkeys are the answer to this problem, and they are rolling out across most major software platforms right now. We recommend that you implement passkeys in your own systems, too.

Why we're flagging this

As a technology partner, part of our job is to help you cut through the noise and point out the things that really matter.

Right now, that means a shift that is moving faster than anything we have tracked before. AI has made phishing attacks cheap and easy to run at a scale we haven't seen before, and the security industry's answer is to move away from relying on passwords and MFA altogether, in favour of passkeys.

Microsoft is a good example. It took the company several years to make MFA the default for existing Microsoft 365 organisations (known as tenants). With passkeys, it took less than two months: Microsoft announced the change in July 2026 and started making passkeys the default for many users in existing tenants from 1 September. This pace is unprecedented and shows how seriously the threat is being taken.

What has changed

An attacker can set up a "proxy" site with a domain name that looks very similar to yours, which relays traffic between the user and your real site. If a user is tricked into visiting the proxy site, their password and their MFA response are exposed to the attacker, who then gains access to your system. Ready-made kits that do this can be rented for around £100.

The hard part for the attacker has always been getting a user to click on a link to the proxy site. What has changed is that AI makes phishing attacks much more likely to succeed. In other words, it is now much easier to trick users into visiting a malicious proxy site than it used to be.

I explain how this works in more detail in this short video:

How passkeys help

Passkeys differ from passwords in several ways, but two of them matter most here:

1. They are tied to a specific domain. A user simply cannot use a passkey on a malicious proxy site, no matter how hard they try. This very effectively shuts down the proxy-site attack described above.
2. They are never actually sent to the site, so they cannot be intercepted. Instead, the server and the client exchange a one-time challenge and response that proves the client holds the passkey, without revealing it.

Passkeys are not perfect. They still have some usability issues, although these are getting better, but they are significantly more secure than passwords with MFA. You will also need to keep password and MFA as a fallback, which means you can't eliminate the threat completely – at least not in the short term.

What do I need to do?

We strongly recommend that you implement passkeys in your solution. Most of the major identity platforms, such as Microsoft Entra External ID, Okta and Auth0, already support them.

You will need to add some code to your system and think through user flows, password resets and support. If you are using Azure AD B2C, you will need to migrate to Microsoft Entra External ID before you can add passkeys.

We also recommend planning to make the password and MFA fallback more involved for users over time, so that attackers find it harder to trick users into using it. This might mean extra steps, a time delay or other mechanisms.

What next?

Get in touch with us to arrange a short call, and we'll talk through what this means for your specific setup. It doesn't matter what you are using today – we'll work out the right path together. As always, we're here to help with any questions along the way.