From Passwords to Passkeys: Rethinking Digital Trust in the Age of AI
The conversation about passkeys replacing passwords as the default sign-in method has accelerated rapidly. The National Cyber Security Centre (NCSC) has emerged as a catalyst for this transition, describing the move as an opportunity to “overhaul decades of security practice.”
The message is becoming harder to ignore: traditional, static passwords no longer adequately defend against modern, automated threats.
AI is changing the economics of cybercrime.
Artificial intelligence has transformed cybercrime into an increasingly efficient, industrial-scale operation. Researchers are already uncovering examples of agentic ransomware, pointing to a future in which autonomous systems can carry out attacks with minimal human intervention.
Cybercriminals are also using AI to automate credential-stuffing attacks, generate highly convincing phishing campaigns and operate at a speed and scale that traditional, human-centric defences struggle to match.
For organisations, this makes moving away from passwords more than a convenience. It is becoming a fundamental security requirement.
Yet adoption remains closely tied to the maturity of an organisation’s identity and access management (IAM) strategy. Among businesses with less mature IAM capabilities, or no formal IAM strategy, only 30% are embracing password alternatives.
Without stronger passwordless systems, organisations will continue to leave the door open to attackers.
The password problem: friction versus security
For years, identity security was largely treated as an operational or IT concern. Today, that is no longer the case.
As customer experience increasingly drives retention and revenue, delivering secure, seamless authentication has become a commercial imperative.
Passwords create an inherently difficult trade-off. Requiring users to create unique, complex credentials can lead to password fatigue and poor user experiences. But when users reuse passwords or choose easily guessed phrases, organisations create opportunities for attackers.
In other words, when security becomes too difficult to use, users find ways around it—and the business ultimately pays the price.
Trust is also a major issue. Although much of the British public is concerned about identity theft and fraud, only 17% fully trust organisations to manage their identity data.
Passkeys offer a fundamentally different approach.
Why passkeys change the equation
Passkeys use cryptographic authentication rather than shared secrets. The private key stays securely stored on the user’s device and isn’t sent to a central server or application.
That means no password database contains reusable credentials for an attacker to steal.
Passkeys also resist phishing. Unlike passwords, they are cryptographically bound to the legitimate website or application domain, making it significantly harder for attackers to trick users into authenticating against a fraudulent site.
The result is a security model that improves both protection and usability: users no longer need to remember complex credentials. At the same time, organisations reduce their exposure to some of the most common forms of credential attacks.
But passwordless authentication’s implications extend beyond human users.
The rise of the autonomous workforce
The emergence of agentic AI – autonomous systems that operate with minimal human intervention – exposes another fundamental weakness in traditional authentication.
Passwords were designed for human beings to remember.
An autonomous AI agent, whether acting as a digital assistant, personal shopper, or part of an automated business workflow, cannot safely “remember” a password the way a person can. Storing credentials in code, sharing session tokens or embedding secrets into automated workflows can create persistent security vulnerabilities.
The risks grow even greater when AI agents inherit human users’ credentials.
If a compromised or rogue agent gains access to over-privileged credentials, it can potentially access and exfiltrate sensitive information at machine speed, far faster than traditional security teams can detect and respond.
The solution is to treat machine identities as first-class identities.
AI agents should have distinct identities, narrowly defined permissions, and time-bound credentials appropriate to the task they perform. Cryptographic credentials, including passkeys and other decentralised identity mechanisms, can help organisations authenticate and audit these interactions without exposing human users’ underlying credentials.
This is an important shift: the future of identity security will not simply be about proving that a person is who they claim to be. It will also be about establishing trust in the machines acting on their behalf.
From passwords to passkeys
The technology industry is helping drive this transition. Major technology companies, including Google and Amazon, are investing heavily in passkeys to improve both account security and customer convenience.
For organisations that delay, the risk is increasingly clear: they are defending a digital perimeter designed for a different era.
But replacing passwords is easier said than done.
Many organisations still depend on legacy applications and core IT systems where passwords are deeply embedded. For IT leaders, moving away from these systems can appear to require extensive code rewrites, specialist development resources and significant operational disruption.
That makes a wholesale replacement unrealistic for many businesses. Instead, organisations need a way to modernise authentication progressively.
Modernising identity without disrupting the business
Modern low-code and no-code identity platforms can help bridge the gap between legacy infrastructure and modern authentication.
By letting teams visually design, test, and deploy sophisticated authentication journeys, identity orchestration platforms can introduce new security capabilities without forcing organisations to replace their entire technology stack.
This creates a more pragmatic path to passwordless adoption.
Organisations can progressively introduce passkeys, biometric authentication and other modern verification methods while maintaining existing workflows and legacy systems where necessary.
The goal is not simply to replace one login mechanism with another. The goal is to create an identity architecture that can adapt as threats, technologies, and user expectations evolve.
For businesses, this makes identity orchestration more than a security tool. It becomes a business enabler, allowing organisations to modernise security while protecting user experience, availability and operational continuity.
The future of trust starts with identity security. Automation
Automation, deepfakes, and increasingly autonomous software are reshaping the threat landscape. In this environment, a static, point-in-time login is becoming increasingly outdated.
The NCSC’s call to rethink established security practices reflects a broader industry shift: passwords are no longer a sufficient foundation for digital trust.
An identity-first approach, centred on passkeys, passwordless authentication, and robust identity orchestration, helps organisations reduce user friction while strengthening the security of both human and machine identities.
As AI becomes increasingly embedded in how businesses operate, trust can no longer be established once at login and then assumed indefinitely. The future belongs to organisations that can continuously verify what they are allowing and whether that access remains trustworthy.
Moving beyond passwords is not simply an upgrade to authentication. It fundamentally rethinks how digital trust works in an AI-driven world.