---
title: "5 billion passkeys, yet 57% of firms still sign staff in with a phishable factor"
summary: "What the FIDO Alliance’s survey of 1,400 organisations and 11,000 consumers in ten countries found in April 2026, and what passkey sign-in costs at five identity providers."
url: https://www.thetechbag.com/blog/passkeys-phishable-mfa-workforce
format: Analysis
desk: "Identity & access"
published: 2026-05-07
facts_checked: 2026-05-07
author: TechBag (The TechBag Journal)
tags: ["passkeys","phishing-resistant MFA","FIDO2","FIDO Alliance","Microsoft Entra ID","Okta","Cisco Duo","miniOrange","JumpCloud","NIST SP 800-63B-4","CISA","RBI"]
cover: https://www.thetechbag.com/blog/covers/passkeys-phishable-mfa-workforce.png
---

# 5 billion passkeys, yet 57% of firms still sign staff in with a phishable factor

*What the FIDO Alliance’s survey of 1,400 organisations and 11,000 consumers in ten countries found in April 2026, and what passkey sign-in costs at five identity providers.*

Analysis · Identity & access · By TechBag · Published 2026-05-07 · Facts checked 2026-05-07 · Canonical: https://www.thetechbag.com/blog/passkeys-phishable-mfa-workforce

The short version

- Most organisations still sign staff in with something a fake login page can collect. In the FIDO Alliance’s April survey of 1,400 organisations with 500 or more staff in ten countries, 57% named a phishable method as the main daily sign-in: a password with an app push or code (28%), with an SMS or email code (18%), or on its own (11%). Consumers moved faster: 75% have switched a passkey on.[1][2]
- The gap is cryptographic, not cosmetic. A lookalike page can relay a code or a push approval in real time; a passkey or a smart-card certificate answers only the real site. CISA calls FIDO and PKI methods the phishing-resistant ones, and NIST’s 2025 rules say a typed code can never count.[3][4]
- It is not expensive. At the four identity providers we priced tier by tier, passkey or FIDO2 sign-in starts at US$3 to US$6 a user a month; the risk engine on top costs more. In India, RBI’s authentication Directions, in force from 1 April 2026, still allow SMS codes for payments, so the case for dropping them at work rests on risk, not a deadline.[9][10][16]

World Passkey Day, 7 May, brought the FIDO Alliance’s annual count: an estimated 5 billion passkeys in use worldwide.[1] Your phone, your email provider and probably your bank already offer one. The question for whoever runs sign-in at a company is narrower. If passkeys are this common, why do most workforces still rely on codes and pushes, which kind of passkey should staff get, and what does the switch cost at the identity provider you already pay?

## Consumers took passkeys; offices kept the password

FIDO’s survey, run by Sapio Research in April 2026, asked 11,000 consumers and 1,400 workforce decision-makers in the US, the UK, France, Germany, Australia, Singapore, Japan, South Korea, China and India. 90% of consumers know what a passkey is, 75% have enabled one on at least some accounts, and 49% use one “whenever possible” or “most of the time”. The 5 billion figure is FIDO’s own estimate, built from public data and its members’ deployment data.[1][2]

Organisations look busy too: 68% have deployed, are deploying or are piloting passkeys for staff, and 82% call a fully passwordless workforce a goal they have reached or are pursuing. Deployment is not use. Only 30% say a passkey is the method employees sign in with most often, and 28% say most of their workforce is already fully passwordless. FIDO’s report puts it in a heading: “Deploying Passkeys and Eliminating Passwords Are Not the Same Thing.”[2]

**Figure: Three in four consumers have switched a passkey on; fewer than one organisation in three signs staff in with one**

*Share of consumers (11,000) and of organisations with 500+ staff (1,400) in ten countries, survey fielded April 2026*

75%

Consumers who have enabled a passkey on at least some accounts

68%

Organisations deploying, rolling out or piloting workforce passkeys

30%

Organisations where a passkey is the main daily sign-in

28%

Organisations that say most of the workforce is fully passwordless

US 37%, Europe 21%, Asia-Pacific 32%

Source: FIDO Alliance, The State of Passkeys 2026 (Sapio Research), questions 1, 6, 7 and 10 · as of 7 May 2026

The US is furthest along at finishing the job, with 37% of its organisations fully passwordless against 21% in Europe. Yet even in the US, 56% still sign staff in primarily with a password.[2]

## What 57% means: three sign-ins a fake page can collect

FIDO asked which method employees use most often today. The phishable 57% is made of a password plus an authenticator app’s push or six-digit code (28%), a password plus an SMS or email code (18%), and a password alone (11%). The rest use passkeys (30%) or a smart card or certificate (12%). The password-led share barely moves by region: 56% in the US, 59% in Europe, 57% in Asia-Pacific.[2]

**Figure: 57% of organisations still sign staff in with something a fake login page can collect**

*Sign-in method employees use most often, share of 1,400 organisations with 500+ staff in ten countries, April 2026*

- Password + authenticator app (push or code)28% 28%
- Password + SMS or email code18% 18%
- Password only11% 11%
- Passkey30% 30%
- Smart card or certificate12% 12%

|  | Value (%) | Share |
| --- | --- | --- |
| Password + authenticator app (push or code) | 28 | 28% |
| Password + SMS or email code | 18 | 18% |
| Password only | 11 | 11% |
| Passkey | 30 | 30% |
| Smart card or certificate | 12 | 12% |

Source: FIDO Alliance, The State of Passkeys 2026, question 10 · as of 7 May 2026 · shares as published; they sum to 99% because of rounding

Why the phishable methods stay: among organisations not yet fully passwordless, 16% say password plus MFA is sufficient for now, and the same share point to legacy systems or account recovery. Among those with no passkey plans for two years, 21% believe their push or one-time-code MFA is good enough for their risk.[2] FIDO’s report calls that belief “a risk that the data on ongoing account compromise does not support”; a third of its consumers had an account compromised or received a breach notice in the past year.[2]

## Why a code or a push can be relayed and a passkey cannot

CISA’s guidance ranks the forms of MFA from strongest to weakest. SMS and voice codes are “vulnerable to phishing, SS7, and SIM swap attacks” and should be a last resort. App codes, and push with number matching, remain “vulnerable to phishing attacks”. Plain push adds push bombing, in which an attacker fires prompts until a tired user taps Accept. Only FIDO/WebAuthn and PKI-based methods are listed as “resistant to phishing”.[3]

The reason is in the protocol. NIST’s revised authentication guideline, SP 800-63B-4 of August 2025, defines phishing resistance as preventing the disclosure of authenticator outputs “to an impostor verifier”, and says authenticators that involve manual entry of an output, such as one-time codes, “SHALL NOT be considered phishing-resistant”.[4] A code is a secret the user carries across, and whoever runs the page receives it. A passkey answers a challenge with a signature bound to the site’s domain, so a lookalike page gets nothing it can replay.

**Figure: A relay page passes on the password and the code; a passkey signs only for the real site**

*How an adversary-in-the-middle phishing page defeats code and push MFA, and where a passkey stops it, per CISA and NIST guidance*

1. 01The lureAn email sends the employee to a copy of the company’s sign-in page, on a domain the attacker owns.
2. 02The relayThe page passes the password and the six-digit code to the real portal as they are typed; a push prompt reaches the real phone and gets approved.
3. 03The sessionThe real portal sees a valid sign-in and hands its session to the attacker. Number matching does not help: the user is reading the real numbers.
4. 04Where a passkey stops itThe browser asks the passkey to sign only for the domain it was created on. The copy page’s domain gets no valid answer, and there is no code to type.

Source: CISA, Implementing Phishing-Resistant MFA (October 2022); NIST SP 800-63B-4 (August 2025) · as of 7 May 2026

Passkeys come in two kinds, and choosing between them is the real decision. A device-bound passkey lives on one security key or one phone and cannot be copied. A synced passkey is held by a provider such as Apple iCloud Keychain or Google Password Manager and follows the user to every device.[5] NIST allows syncable authenticators up to its middle assurance level, AAL2, but says they “SHALL NOT be used at AAL3”, because syncing requires the private key to be exportable. Certificate-based sign-in is phishing-resistant too, but in CISA’s words it “requires highly mature identity management practices”.[4][3]

ReportedHow organisations split, and what the vendors advise

Of organisations using workforce passkeys, 50% mix device-bound and synced, 23% mainly use synced and 22% mainly device-bound.[2] Microsoft’s documentation for synced passkeys in Entra ID, a preview in March, says to treat them as phishing-resistant but with the posture of other unattested authenticators, and for high-assurance cases to “enforce attestation and restrict registration to approved device-bound authenticators”.[5] Okta’s documentation describes an administrator setting that blocks syncable passkeys.[7]

## Passkeys sit in the cheap tiers; the risk engine does not

We read the published plans of five identity providers as their pages stood before 7 May. Cisco Duo’s Free edition, for up to 10 users, does not list phishing-resistant MFA; Essentials, at US$3 a user a month, lists it along with passwordless sign-in through Duo Mobile and FIDO2, and risk-based authentication starts in Advantage at US$6.[9] Microsoft lists Entra ID P1 at US$6 and P2 at US$9. P1 brings Conditional Access, whose authentication strengths let an administrator require a phishing-resistant method for an app; risk-based Conditional Access is a P2 feature. Device-bound passkeys on security keys and in Microsoft Authenticator are generally available, and synced passkeys were in preview.[10][11][12][6]

Okta’s Starter suite, at US$6, includes MFA, and Okta documents its FIDO2 (WebAuthn) authenticator as meeting the “device-bound, phishing-resistant” requirements; Adaptive MFA, which weighs device and network context, comes in Core Essentials at US$14 or Essentials at US$17, against a US$1,500 annual minimum.[7][8] miniOrange puts FIDO2 and WebAuthn passwordless sign-in, and its adaptive rules, in Premium at US$3; its US$2 tier lists neither.[13] JumpCloud sells JumpCloud Go, which its documentation calls phishing-resistant, device-bound and hardware-protected, à la carte at US$5 a user a month billed annually, with Conditional Access a separate US$3.[14][15]

**Figure: Phishing-resistant sign-in starts at US$3 to US$6 a user a month; risk-based policy adds up to US$8 more**

*US$ list price per user per month, billed annually: entry tier with passkey or FIDO2 sign-in, and first tier with risk-based or adaptive policy, pricing pages December 2025 to April 2026*

|  | Passkey or FIDO2 sign-in | Risk-based or adaptive policy | Change |
| --- | --- | --- | --- |
| Cisco Duo (Essentials, Advantage) | 3 | 6 | 100% |
| miniOrange (Premium, both in one tier) | 3 | 3 | 0% |
| Microsoft Entra ID (P1, P2) | 6 | 9 | 50% |
| Okta (Starter, Core Essentials) | 6 | 14 | 133% |

Source: Pricing pages of Cisco Duo (30 Apr 2026), Microsoft (30 Apr 2026), Okta (12 Apr 2026) and miniOrange (13 Dec 2025), as preserved by the Internet Archive; TechBag reading · as of 30 April 2026 · for Microsoft the entry tier is P1, the first that can require a phishing-resistant method by policy; JumpCloud is sold à la carte and is left out

TechBag countTechBag count: price is not the barrier

All five providers list a FIDO2 or passkey method at or below US$6 a user a month, billed annually; none keeps it to a quote-only tier. We counted the feature rows each provider publishes per tier, not trial behaviour, and excluded discounts and reseller prices.

The survey agrees that money is rarely the blocker on its own. The barriers rated highest are compatibility with legacy internal systems (38%), budget approval (35%) and device recovery (33%). Among technical concerns, the exportability of synced passkeys and shared devices such as kiosks and frontline terminals tie at 39%, and 26% say their current identity provider lacks support.[2]

Our view

Our view: give administrators, finance and the helpdesk device-bound passkeys or security keys first, the first phase CISA itself suggests; let everyone else use synced passkeys; then remove SMS and email codes as fallbacks, because a phishing-resistant method offered beside a phishable one protects only the people who pick it.[3] The case against: synced passkeys move trust to Apple’s or Google’s account recovery, and a business with many shared devices will need security keys, not phones.

If you are buying this in India

India is one of FIDO’s ten countries, with 1,000 consumers and 100 organisations, and on every measure the report breaks out it is further ahead and more exposed than the average. 88% of Indian consumers have enabled a passkey, against 75% globally. 49% had an account compromised or a breach notice in the past year, against 33%; FIDO calls India the outlier. 64% say they are likely to abandon a purchase or sign-in over a forgotten password, the highest of any country, and 76% of Indian organisations are deploying or piloting workforce passkeys, against 68%.[2] The report gives no Indian figure for phishable primary sign-in, and the workforce number rests on 100 respondents, roughly ±8 points by our calculation at 95% confidence.

**Figure: Indian consumers use passkeys more and lose accounts more; Indian firms are ahead on workforce pilots**

*Share of respondents, India against the ten-country total, FIDO Alliance survey fielded April 2026*

|  | Ten-country total | India |
| --- | --- | --- |
| Enabled a passkey | 75 | 88 |
| Compromised or notified | 33 | 49 |
| Would abandon sign-in | 47 | 64 |
| Firms piloting passkeys | 68 | 76 |

Source: FIDO Alliance, The State of Passkeys 2026, regional slides for questions 1, 4, 5 and 6 · as of 7 May 2026 · India: 1,000 consumers, 100 organisations

The regulation that took effect this spring governs payments, not staff sign-in. RBI’s Authentication Mechanisms for Digital Payment Transactions Directions of 25 September 2025 required compliance by 1 April 2026: every digital payment needs two distinct factors, one of them dynamic and unique to the transaction, and if a loss arises from a transaction that did not comply, “the issuer shall compensate the customer for the loss in full without demur”. The Directions are technology-neutral. They note that the ecosystem “primarily adopted SMS-based One Time Password”, list SMS OTP among permitted factors, and give card issuers until 1 October this year to validate cross-border card-not-present payments.[16] An Indian company that wants phishing-resistant sign-in for its own staff will not find a deadline; it will find a risk argument and a price.

Microsoft’s India page lists Entra ID P1 at ₹500 and P2 at ₹750 a user a month, paid yearly. For 200 staff, P1 comes to ₹12,00,000 a year; the page does not say whether tax is included, and if it is not, GST at 18% makes it ₹14,16,000.[17] A company on Microsoft 365 E3 or Business Premium already has P1, which Microsoft includes in both, so the first step is often a Conditional Access policy rather than a purchase.[10]

How we did this

Figures as of 7 May 2026

Survey figures are the FIDO Alliance’s, from its 7 May press release and the 47-page report: Sapio Research fieldwork in April 2026, 11,000 consumers (margin of error ±0.9 points) and 1,400 decision-makers at organisations of 500 or more staff (±2.6 points) in ten countries. The 5 billion passkeys figure is FIDO’s estimate, not a count. Shares of the main sign-in method are as published and sum to 99%. India’s figures come from the report’s regional slides; the ±8-point margin for its 100 organisations is our calculation. Vendor prices and features are list prices in US$ (₹ for Microsoft India) per user per month, billed annually, from each vendor’s page as preserved by the Internet Archive on the date shown in the sources, the latest capture on or before 7 May 2026. In the price chart, the entry tier is the lowest paid tier whose published plan includes FIDO2 or passkey sign-in, or for Microsoft the first that can require it by policy; the second value is the first tier that lists risk-based or adaptive policy. Quotes, discounts and reseller prices are excluded. We did not test any product.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [FIDO Alliance: FIDO Alliance reports accelerating global passkey adoption on World Passkey Day 2026](https://fidoalliance.org/fido-alliance-reports-accelerating-global-passkey-adoption-on-world-passkey-day-2026/) — 7 May 2026
2. [FIDO Alliance and Sapio Research: The State of Passkeys 2026, Global Consumer and Workforce Report (47 pages; fieldwork April 2026)](https://fidoalliance.org/wp-content/uploads/2026/05/The-State-of-Passkeys-Global-Consumer-and-Workforce-Report-1.pdf) — 7 May 2026
3. [CISA: Implementing Phishing-Resistant MFA (fact sheet)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf) — October 2022
4. [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (phishing resistance, syncable authenticators, AAL3)](https://pages.nist.gov/800-63-4/sp800-63b.html) — August 2025
5. [Microsoft Learn: How to enable synced passkeys (FIDO2) in Microsoft Entra ID (preview)](https://web.archive.org/web/20260316164552/https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-synced-passkeys) — page as of 16 March 2026 (Internet Archive)
6. [Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID (device-bound support; synced in preview)](https://web.archive.org/web/20260311024654/https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2) — page as of 11 March 2026 (Internet Archive)
7. [Okta Help Center: Configure the FIDO2 (WebAuthn) authenticator](https://web.archive.org/web/20260216233159/https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-webauthn.htm) — page as of 16 February 2026 (Internet Archive)
8. [Okta: Pricing, Workforce Identity suites (Starter, Core Essentials, Essentials; US$1,500 annual minimum)](https://web.archive.org/web/20260412153102/https://www.okta.com/pricing/) — page as of 12 April 2026 (Internet Archive)
9. [Cisco Duo: Editions and Pricing (Free, Essentials, Advantage, Premier)](https://web.archive.org/web/20260430151839/https://duo.com/editions-and-pricing) — page as of 30 April 2026 (Internet Archive)
10. [Microsoft: Microsoft Entra plans and pricing (US)](https://web.archive.org/web/20260430184050/https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing) — page as of 30 April 2026 (Internet Archive)
11. [Microsoft Learn: Conditional Access authentication strengths (P1 prerequisite; phishing-resistant MFA strength)](https://web.archive.org/web/20260408101522/https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths) — page as of 8 April 2026 (Internet Archive)
12. [Microsoft Learn: Microsoft Entra licensing (risk-based Conditional Access in P2)](https://web.archive.org/web/20260421083109/https://learn.microsoft.com/en-us/entra/fundamentals/licensing) — page as of 21 April 2026 (Internet Archive)
13. [miniOrange: IAM and CIAM pricing (Employee IAM: Essential, Premium, IAM Suite)](https://web.archive.org/web/20251213064607/https://www.miniorange.com/iam/pricing) — page as of 13 December 2025 (Internet Archive)
14. [JumpCloud: Pricing (à la carte products, billed annually)](https://web.archive.org/web/20260410084240/https://jumpcloud.com/pricing) — page as of 10 April 2026 (Internet Archive)
15. [JumpCloud Support: Get started with JumpCloud Go](https://web.archive.org/web/20260103091416/https://jumpcloud.com/support/get-started-jumpcloud-go) — page as of 3 January 2026 (Internet Archive)
16. [RBI: Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, RBI/2025-26/79, paras 1, 3, 5, 6, 9 and 10](https://www.rbi.org.in/Scripts/NotificationUser.aspx?Id=12898) — 25 September 2025
17. [Microsoft: Microsoft Entra plans and pricing (India, ₹)](https://web.archive.org/web/20260104110924/https://www.microsoft.com/en-in/security/business/microsoft-entra-pricing) — page as of 4 January 2026 (Internet Archive)

Related on TechBag: [our note on what Entra ID P1 covers](https://www.thetechbag.com/blog/organizations-can-use-identity-access-management-iam) maps the wider identity checklist onto Microsoft’s tiers; [our piece on phishing training](https://www.thetechbag.com/blog/guarding-inbox-essential-email-security-practices-2024) shows why the fix cannot rest on staff spotting the fake page.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [Entra ID P1 covers 5 of 7 IAM controls](https://www.thetechbag.com/blog/organizations-can-use-identity-access-management-iam) — the identity checklist mapped onto Microsoft's tiers
- [Phishing training cut failures by 1.7 points](https://www.thetechbag.com/blog/guarding-inbox-essential-email-security-practices-2024) — why sign-in cannot rely on staff spotting the fake page