Passwords are no longer “good enough” for business accounts. Passkeys (and other phishing‑resistant options like FIDO2 security keys) reduce account takeover risk and cut down on support tickets for resets.
What are passkeys?
Passkeys replace passwords with cryptographic sign‑in.
- They’re tied to the specific website/app.
- They use device security such as face, fingerprint, or a PIN.
- They’re designed to be phishing‑resistant, because there’s no reusable password to steal.
Why SMEs should care right now
UK small businesses are being targeted more often because:
- Email accounts unlock everything (invoices, payments, supplier comms).
- MFA fatigue and push‑spam attacks pressure staff into approving a login.
- One compromised mailbox can lead to invoice fraud and ransomware.
The big shift: passwordless is going mainstream
Microsoft and other major platforms are continuing to expand passkey support, including improvements to passkey manager support in Windows 11.[1]
For businesses on Microsoft 365, Microsoft Entra ID is also pushing features that make passkeys easier to adopt, including synced passkeys and smoother account recovery.[2]
Passkeys vs “normal MFA”
Traditional MFA is better than passwords alone, but it can still be tricked.
Passkeys and hardware-backed methods raise the bar:
- No one-time code to type into a fake login page.
- Less reliance on push prompts.
- Stronger protection for admins and high-risk users.
A simple adoption plan (that won’t annoy your team)
- Start with the most important accounts
- Admin accounts
- Finance mailboxes
- Anyone with access to payment approvals
- Pick your approach
- Platform passkeys (Windows/macOS/iOS/Android)
- FIDO2 security keys for higher assurance
- Set guardrails
- Block legacy authentication
- Use Conditional Access / device compliance where appropriate
- Train the team with one rule
- If you didn’t start the sign-in, don’t approve anything.
Quick checklist
- [ ] Admin accounts moved to phishing‑resistant methods
- [ ] Legacy authentication blocked
- [ ] MFA prompts reduced (risk-based rules)
- [ ] Recovery plan in place (so lockouts don’t stop work)
What Clyk can do
- Review your Microsoft 365 / Google Workspace sign‑in setup
- Roll out phishing‑resistant authentication for high‑risk users first
- Provide a simple “how we sign in here” guide for staff
.webp){kind=logo}
%20(1).webp){kind=small}
