If you are moving to passkeys, good. Passkeys are the strongest primitive we have and I would rather your users had them than not. They also do not make the risk conversation go away, and now there is hard data on why.
What the Passkey Index 2026 shows
In October 2026 the FIDO Alliance published its second Passkey Index, built on real sign-in telemetry from the largest consumer passkey deployments in the world, teams that are now two to four years into rollout. The results:
- 36% of successful sign-ins use a passkey, up from 26% in 2025.
- Passkey sign-ins succeed 93% of the time, against 78% for passwords and traditional MFA.
- A passkey sign-in is nearly three times faster, saving about 27 seconds per login.
Passkeys are clearly working where they get used, and I am not arguing against them. I am pointing at the other number: at the best-resourced deployments on earth, almost two out of three sign-ins are still something else. And that 36% is what the leaders see across their whole user base. A rollout that puts passkeys behind a link on an account-settings page, which is most of them, lands far lower, because almost nobody visits that page.
That gap persists for reasons tied to your users and to what passkeys check.
Employees without passkeys still sign in with OTP
Few organizations reach 100% enrollment, and the users who are not enrolled are the expensive ones: the shared workstation, the kiosk, the borrowed phone, the customer who has not opened your app since last year. Pew's 2025 survey found 78% smartphone ownership among US adults 65 and older against 97% under 50, and among adults with household incomes under $30,000 a year, 34% depend on a phone with no home broadband at all, against 4% of adults with incomes of $100,000 or more. If you run a health plan, a pharmacy portal, a benefits system, a utility, or a bill-pay flow, that is not an edge case. That is your user base. Whatever you keep behind passkeys as the fallback is where OTP volume quietly concentrates, and attackers are happy to drive traffic there on purpose.
A passkey proves a key, not a person
A passkey sign-in proves that whoever is signing in holds the private key registered to that account, which is a real and valuable thing to know. It is not proof of a particular device: a synced passkey is available on every device signed in to the same Apple, Google or Microsoft account, and only a device-bound passkey, such as one on a hardware security key, stays where it was created. Either kind tells you nothing about whether the person holding that unlocked device should be doing what they are about to do, whether the session was hijacked ten minutes after the ceremony, or whether the enrollment that created the passkey was legitimate in the first place. That last one matters more than people expect: something has to authorize the very first passkey registration, and in most environments that something is an OTP or a help-desk call. Risk scoring is what keeps the bootstrap and the recovery path from becoming the softest door in the building.
- 1Enrollment and recoveryThe first passkey and account recovery are usually authorized by an OTP or a help-desk call.PasskeyNo passkey coverage
- 2Sign-inMost still use a password or traditional MFA: unenrolled users, shared workstations, kiosks, borrowed phones.Passkey36%~64%PasskeyPassword or other MFA
- 3Session after login“This key checked out at 9:02” is not “this session started looking wrong at 9:41.”PasskeyNo passkey coverage
Authentication is a moment, risk is continuous
A passkey answers a question at the front door and then stops talking. Level of assurance keeps scoring after the login, which is the difference between "this key checked out at 9:02" and "this session started looking wrong at 9:41."
The two technologies want the same thing
Passkeys raise the ceiling on how strong a single verification can be. Risk scoring decides which verifications you need at all, when to demand the strong one, and when to stop charging your users and your budget for a login you already trust.
One note on scale. SecureAuth Assurance Authority scores authentications for more than 20 million users today, across banking, health insurance, pharmacy and care delivery, retail, manufacturing and the public sector. Different regulators, different populations, login volumes that differ by orders of magnitude. Same finding in every one of them: most returning logins are ordinary, and a policy that cannot tell the difference charges you for all of them.
Sources
- Passkey and MFA adoption: FIDO Alliance Passkey Index 2026 (Oct 2026), Okta Secure Sign-in Trends Report.
- The population that stays on OTP: Pew Research Center, "Internet use, smartphone ownership and digital divides in the US" (Jan 2026); Pew Mobile Fact Sheet.
FAQ
Do passkeys replace MFA?
A passkey is a sign-in credential that replaces the password with a private key held on the user's device or synced through their Apple, Google or Microsoft account. For users who have one, a passkey can replace both the password and the one-time code. In the FIDO Passkey Index 2026, passkeys covered 36% of sign-ins even at the largest consumer deployments, so most sign-ins still use another method, and enrollment and recovery often run on OTP. Risk scoring decides when those sign-ins need a stronger check.
What is risk-based authentication?
Risk-based authentication scores each sign-in on signals such as the device and location, and asks for a stronger check when the risk is high. Assurance Authority combines those signals into one level-of-assurance score and keeps scoring after sign-in, so a trusted login goes through and a session that starts to look wrong can be challenged again.