Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Are Adopting Passwordless Authentication
Transcript
- Lucas: So, Luna, you know how every breach report we read starts with stolen credentials? It's like the same sentence over and over. Luna: It really is. 'Attackers gained access using a valid username and password.' You could almost copy-paste it. Lucas: Right. And that's why the move to passwordless authentication is picking up so much steam. The idea is to get rid of the password entirely, not just add another factor on top of it. Luna: Because if there's no password to steal, then credential stuffing and phishing lose their punch. Lucas: Exactly. And this is something that's been talked about for years, but the tech finally feels like it's maturing. The big push right now is around passkeys, which are based on the FIDO2 standard. Instead of typing a password, you authenticate with a device you already have — your phone, your laptop — using a biometric or a PIN. Luna: And that's what Google, Apple, and Microsoft have all been building into their platforms, right? Lucas: They have. And that's a big deal because it means passkeys are becoming part of the default login experience for millions of people. We've seen the numbers on phishing-resistant authentication — it can cut account takeover attempts dramatically. But rolling this out in an enterprise is not just a technical switch. It's a change management problem. Luna: Why is it so different from what we're used to? I mean, we've had multi-factor authentication for a long time, and that's also about not relying on just a password. Lucas: So with MFA, let's say you're using a one-time code or a push notification. The password is still the first factor. If it gets phished, the attacker can often intercept that second factor too — there are whole toolkits for that. Passwordless flips it: the device itself holds the private key, and the server only knows the public key. There's no shared secret that can be leaked or guessed. Luna: So even if an attacker tricks you into visiting a fake login page, there's nothing to type in? Lucas: That's the beauty of it. The private key never leaves the device, and the authentication request is cryptographically bound to the site's origin. So a phishing page can't even get a valid challenge. That's why FIDO2 is considered phishing-resistant. It's a fundamentally different model. Luna: But from a CISO's perspective, moving from passwords to passkeys must be a huge project. You've got legacy apps, you've got employees who are set in their ways. Lucas: It's not a flip a switch thing. You have to assess your application portfolio, figure out which ones support FIDO2, and for those that don't, you might need a bridge or an interim solution. Plus, you have to handle device loss — if someone's phone is the key, what happens when they lose it? You need a recovery process. Luna: Is that why some companies are keeping passwords as a backup? Lucas: Some are, but that kind of undermines the whole point. If you keep a password as a fallback, an attacker only needs to find that weak link. The goal is to remove passwords entirely, but that takes time and a clear inventory. Luna: Have you seen any notable examples of companies doing this well? Lucas: There are some good case studies. I remember reading about a large tech firm that rolled out passkeys to their entire workforce — over 20,000 employees. They saw a significant drop in phishing incidents and helpdesk tickets related to password resets. The employees actually preferred it because they didn't have to remember anything. Luna: That's got to be a win for the IT team too. Password resets are a huge drain on resources. Lucas: Totally. And that's a concrete metric CISOs can point to. But the journey isn't without bumps. There are questions about interoperability — if you buy into Apple's passkey ecosystem, will those work seamlessly on a Windows machine? The FIDO2 standard helps, but there are still edge cases. Luna: And what about the human side? We all have that one colleague who writes their password on a sticky note. Lucas: Funny you mention that. With passwordless, that sticky note problem disappears. But you still need user education, especially for older employees or those who aren't tech-savvy. The good news is that biometrics are intuitive — you just use your fingerprint or face. Most people get it right away. Luna: So what's the realistic timeline for the enterprise to go fully passwordless? Lucas: I'd say we're in the early adopter phase. The tech giants are pushing it, and some forward-thinking enterprises are already there. But large organizations with complex IT environments will probably take a few years. It's not a matter of if anymore, but when. Luna: That sounds like a solid bet. And with cyber insurance increasingly asking about phishing-resistant MFA, passwordless could become a checkbox that gets you better terms. Lucas: That's a great point. Insurance underwriters are starting to recognize the risk reduction. If you can say you've eliminated passwords, that's a much stronger story than 'we have MFA.' Luna: So, for our listeners who are in security roles, what's the first step they should take if they're considering passwordless? Lucas: Start with an inventory. Map out your applications and identify which ones use weak authentication. Then pick a few low-risk internal apps to pilot passkeys. Get feedback from users, measure the impact, and then expand. It's about building momentum, not boiling the ocean. Luna: Yeah, that makes sense. And I suppose it also helps to track metrics like phishing success rates or password reset tickets before and after. Lucas: Absolutely. That's the kind of data that gets leadership buy-in. You can show that the authentication experience got better and security went up — that's a rare win-win. Luna: Before we dive deeper into some of the technical challenges, I want to mention something. You know how we keep this show ad-free and focused on the content? That's because a small group of listeners chip in monthly through buy me a coffee dot com slash fexingo. Lucas: Yeah, it's honestly what keeps us going. We don't have ads, we don't have sponsors, so that support literally funds the production of these episodes. If you find value in what we do, that's a simple way to keep it alive. Luna: No pressure at all, just thought we'd put it out there. Now, back to those technical challenges — one thing that comes up is the question of backup and recovery. If a device is lost, how do you regain access? Lucas: That's a critical piece. Most enterprise solutions have a recovery process — like using a security key or an admin to re-enroll a new device. The key is to make sure it's tested, not just documented. And also, you need to think about onboarding — how do you enroll employees' devices securely in the first place? Luna: I guess you also have to consider what happens if someone leaves the company. You need to revoke their access quickly. Lucas: Exactly. And with passwords, you could just disable the account. With passkeys, you have to revoke the specific device binding, which is actually more granular. But it requires your identity team to have good admin controls in place. Luna: So let's talk about the elephant in the room — the cost. Is passwordless more expensive to implement than traditional MFA? Lucas: It can be, depending on the vendor and the scale. But you have to factor in the cost savings from fewer data breaches, fewer helpdesk calls, and increased productivity. A lot of CISOs find that the ROI is positive within a year or two. And the cost of a single breach is so high that anything that reduces risk is worth it. Luna: And I've heard that some cloud providers are making passkeys free for their own identity services. That's lowering the barrier. Lucas: Yeah, when the platforms themselves bake it in, you don't need to buy extra software. It's just a matter of configuration. That's a big push for adoption. Luna: So, what's the one thing you'd want listeners to take away from this episode? Lucas: That passwords are on the way out, and it's not a question of if but when. The technology is mature, the big players are on board, and the security benefits are clear. For anyone in a business or technology role, starting to plan for passwordless now will put you ahead of the curve. Luna: Well said. And if our listeners want to dig deeper, they can check the show notes for links to FIDO2 resources and some real-world case studies. Lucas: Yeah, we'll have those in the description. Until next time, keep your keys private — and your passwords, well, you won't need them soon.