Discussions about passkeys replacing passwords as the go-to sign-in method have rapidly accelerated. The National Cyber Security Centre (NCSC) has acted as the catalyst for this transition, describing the shift as "overhauling decades of security practice". Finally, the industry has reached a collective point of recognition: traditional, static passwords are a weak defense against modern, automated threats.
AI has turned cybercrime into a highly efficient, industrial-scale enterprise. With researchers uncovering agentic ransomware attacks, we are fast approaching a reality that outpaces traditional human-centric defenses. Cybercriminals routinely deploy industrial-scale AI tooling to orchestrate and deploy vast credential-stuffing attacks and hyper-realistic phishing campaigns at machine speed and scale.
For organizations, the adoption of passkeys and other passwordless verification methods is dependent on the maturity of existing identity and access management (IAM) systems. Of the businesses with less mature, or no IAM strategy in place, only 30% are embracing password alternatives. Without passwordless systems, threat actors will continue to undermine digital trust.
User friction and weak protection
For years, identity security was treated as an isolated concern for the operations department. However, as customer experience dictates corporate revenue, delivering seamless IAM has become a commercial imperative.
Passwords force a broken trade-off: making users create unique, complex strings of characters results in severe password fatigue, while cutting corners by reusing credentials and using easily guessable phrases leaves gateways vulnerable to threat actors. When security kills usability, the business model breaks.
Another barrier passwords create is that, although most of the British public is genuinely worried about identity theft and fraud, only 17% fully trust organizations managing their identity data. Passkeys directly resolve this trust deficit through cryptographic authentication.
Because private keys stay securely on the user's local device and are never shared with a central server or application, there is no central database for hackers to breach. Passkeys are also phishing-resistant, removing the risk of users falling prey to social engineering attempts. Unlike passwords, they are also cryptographically bound to a specific, verified domain name, adding another layer of technological defense against attackers.
Securing autonomous identities
The shift towards agentic AI – fully autonomous systems operating with minimal human intervention – shatters traditional authentication models. Passwords were fundamentally built for human brains to remember.
An autonomous AI agent, such as autonomous digital proxies, personal shoppers and synthetic workflows, cannot "remember" a password without creating severe vulnerabilities, such as hardcoded credentials or shared session tokens exposing permanent risks.
If an agent inherits over-privileged human credentials, a compromised or rogue AI can exfiltrate sensitive data at machine speed, vastly outpacing the response time of traditional security methods.
To secure the growing autonomous workforce, AI agents must be given their own distinct, first-class identities with task-specific, time-bound permissions. Passkeys and decentralized, cryptographic credentials secure these machine identities and allow enterprises to securely verify and audit agentic workflows and interactions, without exposing underlying human credentials.
From passwords to passkeys
The technology industry is driving the momentum behind passkey adoption. Tech giants like Google and Amazon are seeing the need to improve customer convenience and account security, positioning passkeys as their default authentication standard. Businesses that delay moving towards passwordless frameworks are left defending a perimeter built for an entirely different era.
Although most organizations now see the importance of adopting passwordless options, transitioning away from traditional passwords is hindered by real-world complexities. Many core IT systems and legacy infrastructure are reliant on passwords, which remain deeply embedded within business processes.
IT leaders therefore fear that updating these systems will demand massive code rewrites and extensive specialist development resources, meaning replacing them requires careful orchestration.
To address this challenge, modern, low-code or no-code identity platforms allow organizations to visually map, test and deploy sophisticated authentication journeys seamlessly. This enables businesses to introduce modern passwordless options like passkeys or biometric prompts progressively, without disrupting the active user workflow or having to replace entire underlying legacy systems.
By allowing teams to modernize security processes without affecting user experience or uptime, advanced identity orchestration becomes a critical business enabler.
The future of trust starts with identity security
The threat landscape continues to be redefined by automated threats, deepfakes and autonomous software. Against these sophisticated attacks, the concept of static, point-in- time logins is obsolete. The NCSC’s call to action has been the final push many organizations need to drop passwords and rethink how to safeguard digital trust.
Adopting an identity-first approach centered on passkeys and robust identity orchestration allows enterprises to reduce user friction, strengthen the security of both human and machine identities and establish the continuous trust needed to grow confidently in an AI-driven environment.
We've featured the best antivirus software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit