The Guest loves the mornings. He does his rounds, waters the plant, lifts the keyboard and reads what’s under it. There it is, in handwriting, at desk height.
As he puts it, everyone locks the front door and then leaves the key under the mat. A password works the same way. It can be guessed, copied, stolen or handed over. And every time we sign up to a website or app, we hand over another copy of that key and hope it’s looked after. Not every site manages it. If you want proof, pop your email address into haveibeenpwned.com and see how many breaches it turns up in.
Most organisations are still using this ‘key under the mat’ approach to protect their valuable data. The good news is that the replacement is ready, it’s already built into the devices your people use, and it happens to be faster too.
Your data is the prize. Credentials are the key.
Data is currency, and attackers have worked out the cheapest way to get it. Sophos found that 79% of ransomware attacks started with an identity-based approach, either stealing credentials or using ones already stolen.
The volume is staggering. Microsoft reports it blocks 7,000 password attacks every second. And once an attacker is in, they don’t hang about. The Sophos Active Adversary Report 2026 found attackers reached Active Directory a median of 3.4 hours after getting in. Active Directory is the system that decides who can access what across your network. Control it, and an attacker can create their own accounts and open doors to your data. In other words, one stolen login can become a master key to the whole building in an afternoon.
But we already have MFA
Most organisations do, and it has done a lot of good. It hasn’t closed the door, though.
Even organisations with multi-factor authentication (MFA) enabled get compromised through stolen credentials. Sophos’ State of Ransomware 2026 found that among organisations where compromised credentials were the root cause of a ransomware attack, 97% had MFA enabled in some capacity at the time.
MFA is also still exposed to phishing. Codes sent by email or SMS, and one-time passcodes (OTPs) from an app, can all be captured through a fake login page. Even sophisticated users fall for these attacks. Troy Hunt, the well-known security researcher who created haveibeenpwned.com, was duped by a fake login page that stole his MFA code.
There’s a further quality problem. One-time codes and push notifications still rely on a person making a good decision under pressure. Like the example from Troy Hunt showed, attackers use fake login pages that relay codes in real time, and ‘MFA fatigue’ campaigns that push approval prompts until someone taps ‘yes’ just to make it stop actually work.
It’s also worth knowing that this is self-reported survey data. When Sophos’ own incident responders investigated real attacks, they found MFA was missing entirely in 59% of cases. Either way the lesson is the same: enabling MFA alone is not enough.
What makes a passkey different
A passkey replaces the password with a cryptographic key pair (official Passkey explainer from the FIDO alliance). Rather than giving “the key” (your password) to your service provider, you give them a public key instead. The private key stays with you on your device, hardware security key or in your password manager. The private key never leaves your possession, and it can only be used in conjunction with your fingerprint, face scan or device PIN.
According to Sophos’ CISO playbook on passkeys, three things make this a real step change:
- Nothing to steal in transit. No secret crosses the network, so there’s nothing for an attacker to intercept or harvest.
- Built-in phishing resistance. Passkeys are bound to the legitimate website. A perfect replica of your login page gets nothing, because the passkey simply won’t respond to it.
- Whole categories of attack disappear. Brute force, password spraying and credential stuffing all depend on passwords existing. Stolen password lists become worthless.
In other words, you’re no longer asking people to spot the fake login page. The technology does it for them.
When The Guest types in the password from his sticky note and meets a passkey prompt instead, he’s stumped. The key he found no longer opens anything.
Passkeys for everyone
Interestingly Passkeys were available and in use for some – but not all – user accounts in 51% of those organisations mentioned previously that were hit with a ransomware attack.
A passkey on some accounts, while a password still opens the others, protects very little. Attackers will find an easier way in – via people still using passwords.
Getting everyone to understand and adopt passkeys is critical.
The benefits your users will actually notice
Security improvements usually come with a productivity tax. This one comes with a rebate.
Microsoft found users were three times more successful signing in with passkeys than with passwords (98% versus 32%). Signing in with a passkey was three times faster than a password, and eight times faster than a password plus traditional MFA.
For IT teams, the benefit shows up in the queue. No passwords mean: no forgotten passwords, fewer lockouts and far fewer reset tickets. It also takes password resets off the help desk as an attack path, and that’s exactly the process social engineers love to exploit.
For your people, it means no more sticky notes under keyboards for The Guest to find, no more ‘Spring2026#’ rotations, and no more agonising over whether this is the fourth or fifth variation of the same password.
Microsoft has set the deadline
If your business runs on Microsoft 365, this is no longer a ‘one day’ project. In July 2026, Microsoft announced it is phasing out SMS and voice call codes for MFA in Microsoft Entra ID. From 1 February 2027, those codes stop and passkeys become the default way to sign in. Ahead of the cut-off, Microsoft is automatically enabling passkeys for people who currently rely on SMS or voice.
People who aren’t ready risk being unable to sign in when the change lands. Better to plan the switch than have it planned for you.
Rolling passkeys out without the chaos
Passkeys aren’t infallible, and good security hygiene still matters. How you deploy them makes the difference.
- Start with your people. Begin by educating everyone on what passkeys are, how they work and why they should use them. Then encourage them to set up passkeys on the websites and apps that already offer them, before you switch passkeys on in Microsoft Entra ID. Someone who has already signed in with a passkey at home will find the work version easy.
- Use what you already own. Microsoft Entra ID and Windows Hello for Business support passkeys, so many Microsoft 365 environments are closer than they think.
- Pair passkeys with a password manager. Password managers such as 1Password and Bitwarden store and sync passkeys as well as passwords, so people can sign in from any of their devices. Deploy the two hand in hand and you cover the sites that support passkeys and the ones that don’t yet.
- Plan for lost devices. Decide how people recover access before someone loses their phone at the airport. A weak recovery process undoes a strong login.
- Retire the fallbacks. Once passkeys are in place for a group, remove SMS codes and passwords where you can. Leaving the old door open defeats the new lock.
- Measure coverage. Track the percentage of users and systems on phishing-resistant methods. It’s the kind of evidence cyber insurers and auditors now expect.
- Bring people with you. Continue to invest in the skills of your people. Explain the why, not just the how. A two-minute ‘here’s why this is easier’ message does more than a policy document. Security training is not ‘one and done.’
Know what you’re protecting
Passkeys protect the front door. Your people still need to understand what’s behind it, why customer records and financial data are worth so much, and what happens when they get out. Technology and behaviour work best together.
With over 40 years in Australian IT, we’ve seen a lot of security trends come and go. This one is worth your time. It’s one of the rare changes that makes life easier for users and far harder for attackers at the same time. Because a passkey won’t work on a fake site, it all but removes the risk of people handing their login to a phishing page. That means far less riding on the old ‘don’t click the link’ warning.
Ready to retire the password before Microsoft retires SMS codes for you? Start with the people using them. The Guest Prevention Program begins with a free staff awareness assessment covering passwords, MFA prompts and phishing. It shows who’s still leaving the key under the mat.
