Passkeys Move Toward Mainstream as NCSC Backs Shift Away From Passwords

Laurie wrote that AI has turned cybercrime into a highly efficient, industrial-scale enterprise. He pointed to researchers uncovering agentic ransomware attacks and said cybercriminals routinely deploy industrial-scale AI tooling to orchestrate credential-stuffing attacks and hyper-realistic phishing campaigns at machine speed and scale.

For organizations, the article says, adoption of passkeys and other passwordless verification methods depends on the maturity of existing identity and access management systems. Among businesses with less mature or no IAM strategy in place, only 30% are embracing password alternatives, and without passwordless systems, threat actors will continue to undermine digital trust.

The article argues that passwords force a broken trade-off. Requiring users to create unique, complex strings causes password fatigue, while reusing credentials or choosing easily guessable phrases leaves gateways vulnerable. It adds that although most of the British public is worried about identity theft and fraud, only 17% fully trust organizations managing their identity data. Passkeys are presented as a way to address that trust deficit through cryptographic authentication.

Because private keys stay securely on the user's local device and are never shared with a central server or application, the article says there is no central database for hackers to breach. Passkeys are also described as phishing-resistant and cryptographically bound to a specific, verified domain name, adding another layer of defense.

The shift toward agentic AI, or fully autonomous systems operating with minimal human intervention, is said to shatter traditional authentication models. Passwords were built for human brains to remember, but an autonomous AI agent cannot 'remember' a password without creating severe vulnerabilities such as hardcoded credentials or shared session tokens, the article says. If an agent inherits over-privileged human credentials, a compromised or rogue AI can exfiltrate sensitive data at machine speed, outpacing traditional security response times.

To secure autonomous workflows, the article says AI agents must be given distinct, first-class identities with task-specific, time-bound permissions. Passkeys and decentralized cryptographic credentials are proposed to secure machine identities and allow enterprises to verify and audit agentic workflows without exposing underlying human credentials.

The article notes that technology companies are driving passkey adoption. Google and Amazon are positioning passkeys as their default authentication standard, it says, while businesses that delay moving toward passwordless frameworks are left defending a perimeter built for a different era. Most organizations now see the importance of passwordless options, but the transition is hindered by legacy IT systems and business processes that remain reliant on passwords. IT leaders fear that updating these systems will require massive code rewrites and extensive specialist resources. Modern low-code or no-code identity platforms are described as a way to visually map, test and deploy authentication journeys, allowing businesses to introduce passkeys or biometric prompts progressively without disrupting active user workflows or replacing entire legacy systems.

Editor's Summary. The article argues that passkeys and passwordless authentication are moving toward mainstream adoption as AI-powered attacks make passwords less reliable. It highlights NCSC support, technical advantages such as phishing resistance and local private keys, and the need to secure autonomous AI agents with distinct identities.