Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Passwordless Authentication Is Reshaping Enterprise Security
Transcript
- Lucas: Luna, there's a number that's been sticking in my head all week: according to Microsoft, password attacks happen at a rate of about 921 attempts per second. Nearly four million attacks every hour — and the vast majority are automated credential-stuffing against accounts that still rely on a static password. Luna: Nine hundred twenty-one per second. That number is absurd. And it's exactly why the industry has been talking about killing the password for what feels like fifteen years. Lucas: Right — and the talk has finally turned into real deployment. We're now seeing enterprise-grade passwordless authentication at scale. This week alone, Google announced that over 10 million consumer accounts have enabled passkeys, and Microsoft is pushing passkey support across Azure AD and Microsoft 365. But the enterprise story is different from the consumer one. Luna: In what way? Because I've tried using passkeys on my personal accounts and it's smooth — biometric on my phone, done. But I can see why a company with 20,000 employees would hesitate. Lucas: Exactly. The consumer experience is friction-light: you register a passkey tied to your device's biometric sensor or PIN, and then authentication is a fingerprint scan or a face scan. No typing, no password manager, no one-time codes. But for an enterprise, you have to think about device management, recovery if someone loses their phone, integration with legacy apps that don't support WebAuthn or FIDO2 — it's a much bigger puzzle. Luna: So let's back up — what is FIDO2 exactly? Because I hear that acronym constantly, but I think a lot of listeners might not know the mechanics. Lucas: FIDO2 is the standard developed by the FIDO Alliance — Fast IDentity Online — and it's essentially a framework for phishing-resistant authentication. Instead of sending a password over the network, the user's device generates a public-private key pair. The private key never leaves the device. The public key is stored on the server. When you authenticate, the server sends a challenge, your device signs it with the private key, and the server verifies the signature with the public key. There's nothing an attacker can intercept and replay. Luna: So even if a phishing site tricks you into clicking, there's no credential to steal. That's the core promise. Lucas: Exactly. And that's why it's such a leap from traditional multi-factor authentication — even SMS codes or authenticator app codes can be phished in real time. But with FIDO2, the cryptographic key is bound to the origin domain. A passkey registered for 'google.com' simply won't work on 'go0gle.com'. Luna: I want to talk about a real enterprise deployment. Because the theory is great, but I've heard stories about rollout friction that surprised me. Lucas: Sure. Let's talk about a mid-size regional bank — I'll keep the name off the record — that moved about 8,000 employees to passwordless over eighteen months. They used a combination of Windows Hello for Business for their Windows devices and FIDO2 security keys for shared workstations and remote access. The initial pilot went well, but they hit a wall with legacy line of business applications that still required password-based authentication. Luna: That's the classic headache. How did they handle it? Lucas: They built a fallback mechanism using Azure AD's conditional access policies. For the legacy apps that couldn't accept passkeys, they required a temporary access pass — a time-limited code that the user could generate from a trusted device. That gave them a bridge while the app owners modernized. But the interesting thing is what happened to their help desk tickets. Luna: I'm guessing they dropped significantly. Lucas: Seventy percent reduction in password-related help desk calls. That's a massive operational saving. No more 'I forgot my password' or 'my account is locked' calls. The average time to resolve an authentication issue went from twelve minutes to under two. Luna: And that's before you even factor in the security benefit. Fewer calls, fewer attack vectors, lower phishing risk. Lucas: Right. And that bank is not alone. According to a report from the FIDO Alliance, organizations that deployed passwordless authentication saw an average 92 percent reduction in account takeover incidents. That's not a small improvement. Luna: What about the user experience? I know some employees resist change, especially if they're used to their password manager workflow. Lucas: That's the fascinating part. In the bank's survey, after the first month, 88 percent of employees said they preferred the passwordless experience over their old login. The initial friction was mostly about learning where to tap the security key or how to use Windows Hello gestures. But once muscle memory kicked in, the sentiment flipped. Luna: So the learning curve is real but short. What about the cost? Deploying hardware security keys at scale isn't cheap. Lucas: It's not. The bank spent roughly $50 per employee on FIDO2 keys for their initial rollout. But they calculated the return on investment based on help desk savings alone — not counting reduced fraud or avoided breaches — and they broke even in about ten months. After that, it's pure savings. Luna: That's a compelling case. But I want to circle back to a concern I've heard from security architects: what about device loss? If someone loses their phone or their security key, are they locked out? Luna: Actually, before we go there — Lucas, I want to say something. If these conversations are useful for what you're building or running, and if today felt worth a coffee to you, there's a link for that. It's buy me a coffee dot com slash fexingo. No pressure, just awareness. Lucas: Yeah, honestly, listener support is what keeps this show free and ad-free. If it made a difference in your day, that's the smallest possible way to say it mattered. Okay — back to device loss. Luna: Right. So what happens when the device with the private key is gone? Lucas: That's where the recovery model matters. In FIDO2, you can register multiple passkeys per account — one on your phone, one on a laptop, maybe one on a dedicated hardware key. Plus, most enterprise platforms like Azure AD allow an administrator to revoke a lost key and issue a temporary access pass for the user to re-register a new one. The key is to have a policy that requires at least two registered devices at all times. Luna: So it's like having a spare house key with a neighbor. You just need to pre-plan. Lucas: Exactly. And that's a process that enterprises need to document and test. But the industry is getting better at it. Apple, Google, and Microsoft all support passkey sync across devices now — so if you lose your phone, your passkey is recoverable from iCloud Keychain or Google Password Manager, as long as you have another trusted device. Luna: That sync mechanism creates a new attack surface though. If someone compromises your cloud account, they could potentially recover your passkeys. Lucas: It's a trade-off. The sync is encrypted end to end, so even the provider can't see the keys. But yes, it does shift the risk to the cloud account's security. For enterprises, many choose to not sync — they enforce hardware-bound passkeys that stay on a single device and rely on it managed recovery workflows. Luna: I want to talk about the regulatory angle. Are there compliance drivers pushing passwordless? Lucas: Absolutely. The New York Department of Financial Services cybersecurity regulation, for example, has been moving toward requiring multi-factor authentication for all privileged access. But some regulators are starting to specifically recommend phishing-resistant MFA — which is effectively FIDO2. The EU's revised Payment Services Directive, PSD2, also encourages strong customer authentication, and passwordless is seen as a strong approach. Luna: So it's not just a tech trend — it's becoming a compliance expectation. Lucas: Right. And that's accelerating adoption in regulated sectors like finance and healthcare. I spoke to a CISO at a healthcare system last month, and they're planning to move all 15,000 employees to passwordless by the end of 2027, in part because of HIPAA security rule updates that emphasize access control. Luna: What about the remaining challenges? I don't want to make it sound like passwordless is a done deal. Lucas: There are real issues. One is that not all browsers and operating systems support FIDO2 equally. Edge and Chrome are solid, but some older Safari versions had bugs. Another is that many enterprise apps still use protocols like LDAP or RADIUS that don't support WebAuthn. You need a proxy or a gateway to bridge that gap. Luna: And there's the human factor — what about users who are not technically comfortable with biometrics? Lucas: That's a legitimate concern. Some employees are uneasy about fingerprint or face scanning. The solution is to offer pin based passkeys as an alternative — the PIN is still local to the device and never transmitted. It's not as convenient as biometrics, but it's still phishing-resistant. Luna: I think the big picture here is that we're finally moving past the 'password killer' hype into actual infrastructure. The standards are mature, the vendors are aligned, and the ROI is measurable. Lucas: Yeah, I think 2025 and 2026 are going to be remembered as the years enterprise passwordless went mainstream. We're already seeing it in the vendor landscape — Okta, Ping, Duo, all of them have FIDO2 support baked into their core offerings. And Microsoft's investment is huge — they've made Windows Hello and passkey support a default part of their identity platform. Luna: So for a listener who's a security manager or an IT decision-maker, what's the one actionable takeaway? Lucas: Start with a pilot. Pick a non-critical group of early adopters — maybe 200 users — and deploy passkeys for their primary authentication. Measure help desk call volume, time to authenticate, and user satisfaction for three months. The data you get will build the business case for a broader rollout. Don't try to boil the ocean. Luna: And if they need a concrete number to justify it? Lucas: The average enterprise spends about $70 per user per year on password-related help desk support. If you have 10,000 employees, that's $700,000 annually. A passwordless rollout can cut that by 70 percent — $490,000 in savings. Plus the security benefit of eliminating credential theft. That math is hard to ignore. Luna: Alright, I'm convinced. And honestly, I'm looking forward to the day I never have to type a password again. Lucas: Same here. It's coming faster than most people realize.