Almost every significant data breach investigation has a compromised credential somewhere in its timeline: a phished password, a reused passphrase, a brute-forced account. Despite decades of complexity rules, rotation policies and bolted-on multi-factor authentication, the password is still the most reliable entry point for adversaries targeting Australian organisations. In 2026 that is no longer an architectural inevitability. It is a choice, and an increasingly hard one to justify.
Mature passkey technology, updated international standards, tighter APRA expectations and AI-driven adaptive access control mean that organisations still relying on password-based authentication are accepting unnecessary risk. This article explains what the move to passwordless means in practice, how to approach a staged migration, and where governance and compliance obligations fit.
Why passwords keep failing
A password is a shared secret: the user knows it, and so does the server. That creates several attack surfaces. Credentials can be phished, intercepted in transit, exposed in third-party breaches, cracked offline if a hash database is stolen, or reused across dozens of services. Traditional MFA, particularly SMS one-time passwords and email codes, reduces risk but does not solve phishing, because an attacker can relay a real-time OTP as easily as a password.
NIST SP 800-63B Revision 4, published in July 2025, formalises what the security industry has long understood: SMS-based authentication and email OTP are no longer adequate for higher-assurance access. The updated guidance deprecates these methods at Authenticator Assurance Levels 2 and 3, and names cryptographic, phishing-resistant credentials (FIDO2 passkeys and hardware security keys) as the standard for sensitive access.
For Australian organisations, the regulatory signal is just as clear. APRA's 2025 guidance on critical authentication controls requires regulated entities to implement MFA or equivalent controls for all high-risk member activities and all privileged system access, with a compliance deadline of 31 August 2025. APRA has also signalled that its long-term expectation extends to zero trust principles, including continuous verification, which password-based authentication cannot support.
What passwordless authentication means
Passwordless authentication removes the shared secret entirely. Instead of transmitting something the user knows, the system relies on something the user has (a device holding a private cryptographic key) and something the user is (biometric verification to unlock that key). No password leaves the device, and no password is stored on the server. The server holds only a public key, which is mathematically useless without its private counterpart.
Passkeys and FIDO2/WebAuthn
Passkeys are the consumer and enterprise implementation of FIDO2, the authentication standard maintained by the FIDO Alliance and built on the W3C WebAuthn specification. When a user registers a passkey, a unique cryptographic key pair is generated on the device. The private key never leaves the device's secure enclave, and the public key is registered with the service. At login, the service sends a cryptographic challenge, the device signs it with the private key, and the service verifies the signature against the stored public key. There is nothing to phish, intercept or replay.
Adoption has accelerated sharply. The FIDO Alliance's Passkey Index reports that approximately 5 billion passkeys are now in use globally. It also reports that 75 per cent of people have enabled a passkey on at least one account, and that 26 per cent of all sign-ins across supported services now use passkeys. On the enterprise side, 87 per cent of organisations have deployed or are deploying passkeys for workforce authentication, up 14 percentage points since 2022. Passkeys also reduce sign-in time by approximately 73 per cent compared to traditional methods, and organisations have reported an 81 per cent reduction in login-related help desk incidents after deployment.
Two passkey variants matter for enterprise planning:
- Synced passkeys are stored in a platform credential manager (iCloud Keychain, Google Password Manager) and synchronised across a user's devices. They suit broad workforce rollout where device diversity is high.
- Device-bound passkeys are tied to a single hardware authenticator (a FIDO2 security key or a managed device's secure enclave). They suit privileged access, high-assurance roles, and environments where synced credentials carry unacceptable risk.
Gartner's analysis points the same way: by the end of 2026, passwordless authentication is expected to be the default for workforce access across many enterprises, with FIDO2 and passkeys the leading credential type for phishing-resistant enterprise authentication.
Phishing-resistant MFA as an interim bridge
Where full passkey integration is not yet feasible, hardware security keys (FIDO2/U2F) provide phishing-resistant MFA without replacing every credential. Unlike app-based TOTP or push notifications, hardware keys cryptographically bind the authentication to the origin domain, so an attacker cannot harvest a credential from a lookalike site and relay it. That makes hardware keys a strong transitional control for privileged users and high-risk access while broader passwordless infrastructure matures.
Identity at the core of zero trust
Zero Trust architecture rests on one premise: trust is never implicit, it is earned and continuously re-evaluated. In a password-based world, the single login event is the main identity assertion, and once authenticated, users often keep broad access for the whole session. Zero Trust inverts this model.
Passwordless authentication does more than upgrade the credential. It is what makes continuous, risk-based verification technically viable. With a cryptographic identity established at login, organisations can layer contextual signals (device health, location, behaviour patterns, time of access, data sensitivity) to make dynamic access decisions throughout a session rather than only at its start.
This matters most for privileged access. Privileged Access Management (PAM) in a Zero Trust model does not just gate initial access behind strong MFA. It enforces just-in-time privilege elevation, session recording, and continuous re-verification before high-risk operations. A finance director who authenticates by passkey at 9am in Sydney and then tries to start a large wire transfer at 3am from an unrecognised network should face a re-challenge, not silent approval.
AI-driven adaptive access control
Machine learning in identity and access management adds capabilities that static policy cannot match. AI-driven adaptive access control systems ingest continuous signals (login telemetry, device posture, behavioural biometrics, threat intelligence feeds) and produce real-time risk scores that change access decisions without human intervention.
In practice:
- A user authenticating from a known, compliant device on a corporate network gets access with no extra prompts.
- The same user connecting from a new country triggers step-up authentication.
- An account showing rapid lateral movement or unusual data export behaviour has its access suspended automatically, pending review.
- Privileged sessions with anomalous command patterns are flagged for real-time analyst attention.
This adaptive layer raises the cost and complexity of attack. Even if an adversary obtains a valid session token, sustained anomalous behaviour will generate an alert or trigger re-authentication before sensitive data can be exfiltrated.
Governance risks of AI-driven access
The same AI capabilities that improve detection create governance obligations that many organisations have not yet addressed. When an algorithm denies access or suspends an account, who is accountable? How is the decision audited? Can the user appeal, and on what timeline? These questions are already relevant under Australian Privacy Act obligations and, for regulated entities, under APRA's expectations for strong and auditable control frameworks.
Organisations adopting AI-driven IAM should log access decisions in enough detail to support audit, define explainability requirements in advance (especially for privileged access denials), and set up human escalation paths for automated decisions that affect employees or customers. AI augments the identity control plane. It does not replace governance accountability.
Essential Eight alignment
The Australian Signals Directorate's Essential Eight Maturity Model sets MFA requirements at each maturity level. At Maturity Level 2, phishing-resistant MFA is required for internet-facing services and privileged access. At Maturity Level 3, it is required across all user access. Passkeys and FIDO2 hardware keys satisfy the phishing-resistant requirement at all maturity levels; traditional TOTP and SMS OTP do not.
Organisations targeting Maturity Level 2 or above should treat their passwordless migration roadmap as part of their Essential Eight uplift, and should plan to demonstrate phishing-resistant credential coverage in their next assessment.
A staged migration roadmap
A complete passwordless migration does not happen overnight. Legacy applications, workforce habits and recovery mechanisms all need careful management. The following phased approach has proven effective for organisations of varying maturity.
Phase 1: pilot with high-risk and willing users (months 1 to 3)
Begin with a controlled pilot covering IT and security teams, privileged users and early adopters. Deploy FIDO2 hardware keys or platform passkeys for primary authentication to a defined set of modern, FIDO2-compatible systems. Collect detailed feedback on UX, device compatibility and recovery scenarios. Establish your help desk runbook for lost devices and account recovery before the pilot ends.
Phase 2: high-risk user expansion (months 4 to 6)
Extend passwordless authentication to all privileged accounts, executives, finance staff, and anyone with access to sensitive data or critical systems. These users carry the highest breach impact, so they offer the best return on investment for phishing-resistant authentication. For legacy applications that cannot yet support FIDO2, use hardware key-based MFA as a bridge control.
Phase 3: broad workforce rollout (months 7 to 12)
Deploy synced passkeys to the general workforce through managed identity providers (Microsoft Entra ID, Okta, Ping Identity and similar platforms all support FIDO2 passkey registration at scale). Present the change as a UX improvement, faster and simpler sign-in, rather than a security mandate. Run passwords and passkeys in parallel during the transition to reduce disruption.
Phase 4: password retirement and continuous improvement
Once passkey coverage reaches defined thresholds (typically 90 to 95 per cent of accounts), begin disabling password-based authentication for covered systems. Audit legacy application exceptions and set remediation timelines. Add AI-driven adaptive access on top of the established credential baseline, and integrate privileged access management with Zero Trust policy engines for continuous session verification.
Common challenges and how to address them
Legacy application compatibility
Many enterprise applications, particularly older ERP, finance and operational systems, do not support modern authentication protocols. Options include reverse-proxy authentication gateways that front legacy applications with FIDO2-capable login pages, password vaulting through a PAM solution for applications that cannot be modified, and moving legacy application modernisation up the technology roadmap.
Account recovery without a password
The most common objection to passwordless is recovery: "What happens when someone loses their device?" The answer is planning, not avoiding passwordless. Acceptable recovery mechanisms include a second registered authenticator (a backup hardware key or trusted device), verified identity re-enrolment through the IT service desk with identity proofing, and, for high-assurance accounts, in-person verification with a manager sign-off. Avoid SMS or email-based recovery paths, as these bring the phishing vulnerability back at the recovery layer.
User experience and change management
Passkeys typically earn strong user satisfaction once deployed, and the FIDO Alliance's data indicates an 81 per cent reduction in authentication-related help desk calls. The hard part is the transition itself. Invest in clear, role-specific communications, brief video walkthroughs and accessible help resources. Frame the change as removing friction, not adding security theatre.
Key takeaways
- Passwords are structurally broken. No password policy prevents phishing. Phishing-resistant, cryptographic authentication is the only effective remedy.
- FIDO2 passkeys are mature and enterprise-ready. Five billion passkeys are in global use, and 87 per cent of enterprises are deploying them. All major platforms and identity providers support them.
- NIST SP 800-63B Revision 4 and APRA both point the same way. SMS OTP is deprecated for higher-assurance access, and phishing-resistant MFA is the baseline expectation for regulated Australian entities.
- Passwordless is the foundation of Zero Trust identity. Continuous, risk-based verification needs a cryptographic identity anchor, and passwords cannot provide one.
- AI-driven adaptive access raises the cost of attack and adds governance obligations. Build explainability, auditability and human escalation paths in from day one.
- Stage your migration. Start with privileged users and high-risk access. Use hardware security keys as a bridge for legacy environments. Retire passwords in stages, not all at once.
- Essential Eight alignment is direct. Phishing-resistant MFA at Maturity Levels 2 and 3 maps to FIDO2 passkeys and hardware keys, not TOTP or SMS OTP.
Identity is the new perimeter. Organisations that secure it with cryptographic, phishing-resistant credentials, and govern AI-driven access decisions rigorously, will be better placed against the credential-based attacks that dominate today's threats. Those that delay will face an increasingly difficult compliance conversation with APRA, the ASD and their own boards.
CyberCorp works with Australian organisations to design and implement passwordless IAM programs that align with Essential Eight, APRA CPS 234, and Zero Trust architecture principles. To discuss your identity security roadmap, Schedule a GRC Assessment or learn more about our security strategy & governance services.
