Passkeys and FIDO2: An Enterprise Migration Guide

Attackers have stopped guessing passwords and started intercepting everything around them. Microsoft observed roughly 7,000 password attacks per second last year — more than double the 2023 rate — while phishing kits proxy one-time codes in real time and push prompts get approved out of sheer fatigue. The Verizon DBIR still finds the human element in 62% of breaches, and most of the identity attacks behind that number share one property: they work because the user holds a secret that can be told, typed, or approved into the wrong hands.

Passkeys remove the secret. The FIDO Alliance counted an estimated five billion passkeys in use on World Passkey Day 2026, with 68% of surveyed organizations deploying or actively deploying them for employee sign-in. The technology has crossed from early-adopter territory into the default answer to MFA bypass. What has not caught up is migration practice: rolling passkeys out in the wrong order, or leaving recovery paths open, quietly reintroduces every weakness the project was meant to eliminate. This guide covers the order that works.

Why the MFA you already have is being beaten

Conventional MFA was designed against password theft, and it still does that job. But the last three years of incidents show attackers routing around it through three doors, none of which requires breaking cryptography:

• Real-time relay. Adversary-in-the-middle kits proxy the genuine login page, capture the OTP as the victim types it, and steal the session cookie. The code was used once, as designed — by the attacker.
• Prompt fatigue. Push notifications can be approved by a tired thumb at 2 a.m., which is the entire premise of the MFA fatigue attacks that opened the Uber and Cisco intrusions.
• Factor replacement. Why phish a code when the help desk will enroll your device for you? CISA attributes exactly this to Scattered Spider, and SIM swapping does the same to SMS codes at the carrier.

CISA's phishing-resistant MFA guidance draws the conclusion plainly: number matching is the best interim mitigation for push-based MFA, and FIDO/WebAuthn authentication is the gold standard the interim measures are buying time for.

What actually changes with FIDO2

A passkey is a public–private key pair created for one specific web origin. At sign-in, the browser signs a challenge with the private key — unlocked locally by the device's biometric or PIN — and only ever does so for the exact domain the passkey was registered to. Three properties follow, and they are the whole security argument. There is nothing to intercept: no code exists, so a proxy captures nothing. There is nothing to fatigue: no prompt can be approved for a session the user didn't start. And there is nothing to give away on a lookalike domain: the browser simply won't offer the credential to cornpany-inc.com.

The usability argument turns out to be just as strong, which is rare for a security control. Microsoft reports passkey sign-ins succeed about 98% of the time versus 32% for passwords, and run three times faster than password-plus-MFA — which is why it now sees nearly a million new passkeys registered per day. Faster sign-in is not a side benefit; it is what makes the rollout politically survivable.

The last column is the honest one. No authenticator technology protects an enrollment or recovery process that will hand a new factor to a convincing phone call. That is a process problem, and it moves with you into the passkey era.

A passkey migration doesn't eliminate identity attacks. It concentrates them on the few paths you leave open — which is exactly what makes those paths worth engineering properly.

The migration, in the order that works

1. Tier your accounts before you touch technology. Rank identities by blast radius: global and cloud admins, help desk agents, finance approvers, executives, then everyone else. The top tiers get device-bound, phishing-resistant credentials first — this is where CISA tells resource-constrained organizations to start, and where attackers already aim.

2. Enable passkeys alongside existing MFA. Every major identity platform now supports FIDO2/WebAuthn. Turn it on, let early adopters enroll voluntarily, and instrument enrollment and sign-in success from day one. Nothing breaks, and you accumulate evidence for the next phase.

3. Make enrollment trustworthy. A passkey is only as trustworthy as the session that created it. Bootstrap new employees with a time-limited access pass or in-person verification — not an email link plus SMS code, or you have built a phishing-resistant house on a phishable foundation.

4. Harden recovery and the help desk in the same sprint. Lost-device resets and MFA re-enrollment must become high-friction, high-verification events: callback on the number already on file, video-with-ID for privileged accounts, a second registered passkey as the standard backup, deliberate delay plus notification on every re-enrollment. Skip this step and you have changed the technology while leaving the front door open.

5. Go passwordless-preferred, then retire factors. Flip the default sign-in experience to passkeys, then start removing what attackers still want: SMS first, then OTP fallbacks for high-tier accounts, then scheduled password rotation nobody needs anymore. Microsoft's experiments found passwordless-preferred flows cut password use by over 20% immediately — users follow the easier path when it is also the safer one.

6. Measure the humans, not just the rollout. Enrollment percentage is an IT metric. The security metrics are which users still sign in with phishable factors, who falls for simulated AiTM lures, and how those signals trend by team — exactly what a human risk score is built to aggregate. Keep running phishing simulations after rollout: they verify that the phishable paths are actually gone, and they keep testing the social channels — voice, help desk, QR — that passkeys don't cover.

The pitfalls that undo the project

Three patterns account for most failed or hollow migrations. The first is the phishable fallback: if every passkey sign-in silently offers "use your password instead," an attacker just clicks it, and your relay resistance is theater — restrict fallbacks by policy, per tier. The second is legacy protocols: IMAP, POP and other flows that never learned WebAuthn will authenticate with a password forever unless conditional access blocks them. The third is treating the FIDO Alliance's 28% fully-passwordless figure as an indictment rather than a roadmap — the organizations reporting reduced phishing incidents after deploying passkeys got there by retiring factors tier by tier, not by declaring victory at enablement.

Passkeys are the rare control that is simultaneously stronger and easier than what it replaces. The migration succeeds when you sequence it like an attacker would: protect the accounts they want first, close the recovery paths they will pivot to, and keep measuring the human layer that remains — because that layer, not the cryptography, is where the next attempt will land.