Passwords are leaving by attrition

Passkeys have won the argument and not yet won the estate. Adoption surveys describe most large organisations deploying or piloting them, and the same surveys describe most of those organisations still running passwords underneath.

Industry data compiled from an authentication survey reports broad enterprise deployment alongside continued reliance on phishable methods for primary sign-in at a substantial share of firms, which is the tension the whole transition turns on.

The distinction that matters is between adding and removing. Adding a passkey improves the experience and reduces support cost immediately. Removing the password is what removes the attack, and it is the step organisations defer because it is the one that breaks things.

An attacker does not care that a passkey exists. They care whether a password still works, and while a fallback path remains, the strongest available authenticator is the weakest one the account still accepts.

The operational case for deploying anyway is genuinely strong and has nothing to do with security. Reset tickets fall sharply after rollout, sign-in success rates improve, and both show up in a budget line that a security team can point at without arguing about risk.

That is why deployment has outpaced removal. The benefits of adding are immediate and measurable; the benefit of removing is the absence of an incident, which no dashboard displays.

The hard cases are predictable and identical everywhere: shared workstations, contractors on unmanaged devices, kiosks, and the executive travelling with a device that has just failed. Each has a legitimate need for a fallback, and each fallback is a way in.

Account recovery is where the transition usually stalls entirely. A passkey is bound to a device, devices are lost, and the recovery flow built for that eventuality becomes the softest path into the account unless it is designed with the same rigour as the primary method.

That connects the passkey rollout directly to the service desk, because recovery is a help desk function in most organisations, and a desk that can restore access on request is an authentication bypass with a phone number.

Organisations that have actually finished describe the sequence rather than the technology as the achievement. Enrol broadly, measure which accounts have stopped using passwords, then disable password authentication for those accounts specifically rather than waiting for a date when every case is solved.

Attrition rather than migration is the honest description of what is happening. Passwords are not being switched off; they are being used less until switching them off stops being frightening, and the security benefit arrives only at that last step.