5 billion passkeys, yet 57% of firms still sign staff in with a phishable factor

01Consumers took passkeys; offices kept the password

FIDO’s survey, run by Sapio Research in April 2026, asked 11,000 consumers and 1,400 workforce decision-makers in the US, the UK, France, Germany, Australia, Singapore, Japan, South Korea, China and India. 90% of consumers know what a passkey is, 75% have enabled one on at least some accounts, and 49% use one “whenever possible” or “most of the time”. The 5 billion figure is FIDO’s own estimate, built from public data and its members’ deployment data.¹²

Organisations look busy too: 68% have deployed, are deploying or are piloting passkeys for staff, and 82% call a fully passwordless workforce a goal they have reached or are pursuing. Deployment is not use. Only 30% say a passkey is the method employees sign in with most often, and 28% say most of their workforce is already fully passwordless. FIDO’s report puts it in a heading: “Deploying Passkeys and Eliminating Passwords Are Not the Same Thing.”²

The US is furthest along at finishing the job, with 37% of its organisations fully passwordless against 21% in Europe. Yet even in the US, 56% still sign staff in primarily with a password.²

02What 57% means: three sign-ins a fake page can collect

FIDO asked which method employees use most often today. The phishable 57% is made of a password plus an authenticator app’s push or six-digit code (28%), a password plus an SMS or email code (18%), and a password alone (11%). The rest use passkeys (30%) or a smart card or certificate (12%). The password-led share barely moves by region: 56% in the US, 59% in Europe, 57% in Asia-Pacific.²

Why the phishable methods stay: among organisations not yet fully passwordless, 16% say password plus MFA is sufficient for now, and the same share point to legacy systems or account recovery. Among those with no passkey plans for two years, 21% believe their push or one-time-code MFA is good enough for their risk.² FIDO’s report calls that belief “a risk that the data on ongoing account compromise does not support”; a third of its consumers had an account compromised or received a breach notice in the past year.²

03Why a code or a push can be relayed and a passkey cannot

CISA’s guidance ranks the forms of MFA from strongest to weakest. SMS and voice codes are “vulnerable to phishing, SS7, and SIM swap attacks” and should be a last resort. App codes, and push with number matching, remain “vulnerable to phishing attacks”. Plain push adds push bombing, in which an attacker fires prompts until a tired user taps Accept. Only FIDO/WebAuthn and PKI-based methods are listed as “resistant to phishing”.³

The reason is in the protocol. NIST’s revised authentication guideline, SP 800-63B-4 of August 2025, defines phishing resistance as preventing the disclosure of authenticator outputs “to an impostor verifier”, and says authenticators that involve manual entry of an output, such as one-time codes, “SHALL NOT be considered phishing-resistant”.⁴ A code is a secret the user carries across, and whoever runs the page receives it. A passkey answers a challenge with a signature bound to the site’s domain, so a lookalike page gets nothing it can replay.

Passkeys come in two kinds, and choosing between them is the real decision. A device-bound passkey lives on one security key or one phone and cannot be copied. A synced passkey is held by a provider such as Apple iCloud Keychain or Google Password Manager and follows the user to every device.⁵ NIST allows syncable authenticators up to its middle assurance level, AAL2, but says they “SHALL NOT be used at AAL3”, because syncing requires the private key to be exportable. Certificate-based sign-in is phishing-resistant too, but in CISA’s words it “requires highly mature identity management practices”.⁴³

04Passkeys sit in the cheap tiers; the risk engine does not

We read the published plans of five identity providers as their pages stood before 7 May. Cisco Duo’s Free edition, for up to 10 users, does not list phishing-resistant MFA; Essentials, at US$3 a user a month, lists it along with passwordless sign-in through Duo Mobile and FIDO2, and risk-based authentication starts in Advantage at US$6.⁹ Microsoft lists Entra ID P1 at US$6 and P2 at US$9. P1 brings Conditional Access, whose authentication strengths let an administrator require a phishing-resistant method for an app; risk-based Conditional Access is a P2 feature. Device-bound passkeys on security keys and in Microsoft Authenticator are generally available, and synced passkeys were in preview.^1011126

Okta’s Starter suite, at US$6, includes MFA, and Okta documents its FIDO2 (WebAuthn) authenticator as meeting the “device-bound, phishing-resistant” requirements; Adaptive MFA, which weighs device and network context, comes in Core Essentials at US$14 or Essentials at US$17, against a US$1,500 annual minimum.⁷⁸ miniOrange puts FIDO2 and WebAuthn passwordless sign-in, and its adaptive rules, in Premium at US$3; its US$2 tier lists neither.¹³ JumpCloud sells JumpCloud Go, which its documentation calls phishing-resistant, device-bound and hardware-protected, à la carte at US$5 a user a month billed annually, with Conditional Access a separate US$3.¹⁴¹⁵

The survey agrees that money is rarely the blocker on its own. The barriers rated highest are compatibility with legacy internal systems (38%), budget approval (35%) and device recovery (33%). Among technical concerns, the exportability of synced passkeys and shared devices such as kiosks and frontline terminals tie at 39%, and 26% say their current identity provider lacks support.²