Forget Passwords. Passkeys are the Future

The message is clear: do not use passwords. This is the key takeaway from Microsoft’s recent major update aimed at boosting adoption and strengthening security.

“The password era is ending. Bad actors know it, which is why they’re desperately accelerating password-related attacks while they still can,” says Microsoft. The company blocks “7,000 attacks on passwords per second, almost double from a year ago,” but “fortunately, we’ve never had a better solution to these pervasive attacks: passkeys.”

With that, Microsoft is officially phasing out passwords, encouraging individuals and organisations to embrace passkeys as the new standard for digital authentication. This shift is not just about modernising user experience, it’s about countering the rise of phishing, identity theft, and AI-powered cyber threats.

What Are Passkeys?

Passkeys are modern, phishing-resistant credentials that authenticate users through biometrics or secure device-based methods like Face ID, fingerprint scans, or locally stored PINs. Unlike passwords, they cannot be stolen in a phishing attack or reused across systems.

A passkey is reported to deliver a 98% login success rate, meaning fewer failed login attempts, forgotten credentials, or account lockouts. A handy upgrade compared to traditional passwords, which average just 32% success and slower, more frustrating authentication experiences.

Beyond the security gains, they ease the user experience and free up valuable time by removing the friction of password resets.

Why This Matters

Organisations serious about safeguarding digital ecosystems cannot ignore the implications. Passwords have long been a weak link. As the threat landscape intensifies, the traditional login model is proving unsustainable.

The message is clear: the longer organisations rely on passwords, the greater their risk exposure. Transitioning to passkeys brings clear advantages:

• Stronger security.
• Faster user access.
• Fewer IT issues from password resets and account lockouts.

For leadership focused on resilience and operational efficiency, adopting passkeys is a decisive step forward.

Passwords Are Now a Liability

The reality is stark: password-based attacks are accelerating, fueled by automation and AI. According to recent data, adversary-in-the-middle phishing attacks have surged by 146% year on year, and password-based breaches remain among the most common initial access points for cybercriminals.

It’s no longer just about improving security—it’s about eliminating an outdated model that’s putting organisations at constant risk. Traditional password policies, even when backed by 2FA, simply can’t keep pace with modern threats.

Passkeys offer a clean break from this vulnerability—ushering in a simpler, faster, and far more secure way to log in.

Implications for Business Leaders

For forward-thinking organisations, this is a pivotal moment to redefine your security posture.

As the risks linked to password-based systems become untenable, transitioning to passkeys offers both a defensive necessity and a competitive edge. Consider these strategic and practical actions:

• Lead the shift from the top: Set a clear roadmap for phasing out passwords across your organisation, beginning with high-risk and high-impact users (e.g. executives, finance, IT admins).

• Upgrade identity and access systems: Work with your IT team or MSP to ensure your identity platform (such as Entra ID or Okta) supports FIDO2 passkey standards and biometric sign-in.

• Pilot before scaling: Start with a defined user group and specific apps, gather feedback, then expand. Use results to inform organisation-wide rollout and change management plans.

• Educate and empower your workforce: Provide short training and clear FAQs to demystify passkeys. Emphasise security benefits, convenience, and reduced account lockouts.

• Update device policies and asset management: Ensure corporate devices support biometric authentication and manage bring-your-own-device (BYOD) risks through tools like Microsoft Intune.

• Modernise user provisioning workflows: Incorporate passkey setup into your joiner/mover/leaver processes to ensure secure onboarding and offboarding without reliance on shared or temporary passwords.

• Track adoption and reassess policies: Monitor passkey uptake and user feedback. Review and retire legacy password reset infrastructure, password vaults, and MFA prompt policies over time.

• Prepare IT support for a new paradigm: Shift support models from handling forgotten passwords to assisting with biometric issues, device sync, or credential recovery.

This Goes Beyond Authentication

It’s about building resilience against an evolving threat landscape that is accelerating with AI. For business leaders, it’s time to act decisively. Passwords have become a risk, passkeys are the future. The sooner your organisation embraces this, the better positioned you’ll be for what’s coming next. Read the full announcement from Microsoft here.

How Can Diamond IT Help?

As threat actors grow more sophisticated, now is the time to act. At Diamond IT, our experienced Business Technology Consultants and Business Technology Managers we help organisations take control of their security posture in the direction that best suits their needs. 

From strategy and implementation to end-user support, we’ll work with you to reduce risk, improve resilience, and secure access across your environment. Don’t hesitate to reach out to Diamond IT on 1300 307 907, via email at enquiries@diamondit.com.au or by filling out the form below.