Passwords remain one of the most persistent weak points in cybersecurity. Passkeys are presented as an answer to this problem, but according to an analysis published by SecurityWeek, they are not enough to solve the broader question of trust placed in an identity.
A stronger protection than passwords
Passkeys rely on public key cryptography, which replaces shared secrets with cryptographic credentials. There is therefore no longer a password that an attacker could steal, intercept through phishing, or reuse on another service. When properly implemented, they also resist phishing, as authentication is tied to the legitimate service.
The mechanism differs from traditional methods. One-time codes, SMS, or push notifications, even if more robust than passwords alone, remain vulnerable to phishing, so-called ‘man-in-the-middle’ attacks, fatigue from repeated requests (MFA fatigue), SIM swapping, and social engineering. With passkeys, the user’s device retains a private key, while the service holds the corresponding public key. The private key is never transmitted during authentication.
Authenticating is not identifying
Successful authentication provides strong cryptographic proof that an identifier associated with an account has followed the process. It does not, however, say whether the account was legitimately created, whether the underlying identity has been compromised, whether the device is trustworthy, or whether an attacker is acting through an authenticated session.
The risk shifts particularly during enrollment. If an attacker creates or takes control of an account before a passkey is associated with it, the organization can then authenticate the wrong person with a high level of security. The stronger the authentication mechanism, the more important the integrity of this step becomes.
The question also arises when the user changes devices, which happens frequently: lost, stolen, or replaced phones, new laptops, ecosystem changes. If the recovery procedure relies on a password, an SMS code, an email link, a secret question, or a support service, attackers can target this weaker path. As the analysis summarizes, ‘the passkey was not compromised. The attacker bypassed the mechanism.’
Assessing trust over time
According to the analysis, authentication is only one moment in the journey. Modern attacks can hijack already open sessions, compromise trusted devices, abuse privileges, or modify account attributes. In these cases, the authentication mechanism may have worked exactly as intended.
The author therefore proposes complementing passkeys with identity threat detection, which continuously assesses risk. Device characteristics, identity attributes, anomalous behaviors, network information, or account changes can help determine whether an identity remains trustworthy. A known user, from an established device and with usual behavior, should not be hindered. Conversely, a recovery attempt from an unknown device or a change to critical attributes can trigger additional verification.
The model thus shifts from ‘authenticate once, then trust’ to ‘establish trust, continuously assess risk, and react when trust changes.’ Passkeys answer the question of whether the user possesses a legitimate identifier, while identity threat detection addresses the question of whether that identity should still be trusted. Organizations must answer both.
