Securing the Enterprise: How to use passkeys/WebAuthn to become phishing resistant today
summary
Enterprise adoption of passkeys shows concrete traction: 800 million Google users and 175 million Amazon users in the wild, passkey factor validations grow ~2.5x year‑over‑year but only hit about 8% phishing‑resistant validations today while passwords still account for ~50% and SMS/push ~10%. Practical moves include using passkeys as the first factor, buying managed passkey providers (Microsoft and others already support third‑party providers), rolling short session lifetimes, step‑ups, and device‑bound session credentials plus continuous authentication.
AI-written summary · about
chapters (12)
- 0:00Introduction and setup
- 1:32Why phishing resistance matters
- 3:43Current adoption of passkeys
- 5:49Getting started with passkeys
- 7:11Zero Trust principles overview
- 8:14Passkeys in Zero Trust
- 11:23Limiting impact with passkeys
- 13:30Onboarding and recovery challenges
- 14:35Future of passkeys in Zero Trust
- 17:25Managed passkey providers
- 18:47Continuous authentication
- 21:15Summary and call to action
related talks
15mOur future without passwords
52mPasskeys: The Good, the Bad and the Ugly
24mPasskeys and digital identity best practices
37mAuthentication in 2026: A guide to passkeys, digital credentials and more
23mOur future without passwords
41mOur future without passwords
45mPast Time for Passkeys
47mPasswordless Web