Passkeys Finally Grow Up

For about a decade, passkeys have been the future of authentication. You know what that makes them now? The present. Somewhere along the way — while we were all arguing about password managers and MFA fatigue — Apple, Google, and Microsoft just shipped them. To everyone. They're in your phone right now, whether you've noticed or not.

This is the part where I'm supposed to explain what a passkey is, but honestly, the best thing about them is that users don't need to know. That's the whole point. No password to invent, remember, rotate, or reuse across fourteen sites. You want in, you look at your phone or touch the sensor, and you're in. The cryptography underneath is genuinely clever — a key pair where the private key never leaves your device — but the user experience is just: it works.

And it's phishing-resistant in a way passwords never were, because there's nothing to phish. You can't trick someone into typing a passkey into a fake login page. There's nothing to type. The credential is bound to the real site. This is the thing security people have wanted for twenty years, and it arrived not with a bang but with a software update.

So why isn't everyone celebrating? Because for the teams running authentication, the passkey isn't the hard part. The transition is.

Here's what nobody's keynote mentioned: account recovery. What happens when someone loses their phone? What happens when they get a new one and the keys don't come along? Every auth team I know is spending more time on the fallback paths than on the passkey implementation itself. The happy path took a sprint. The "I dropped my phone in a lake" path is taking a quarter.

Then there's the cross-platform mess. Passkeys work beautifully inside one ecosystem. Step outside it — the person with an iPhone and a Windows laptop, the shared workstation, the odd Linux box in the corner of the lab — and things get interesting. Synced passkeys helped. Device-bound keys for high-assurance scenarios helped. But "it just works" still has an asterisk, and the asterisk is where your helpdesk tickets live.

And the legacy systems. Oh, the legacy systems. Somewhere in every enterprise there's an application from 2009 that barely tolerates modern single sign-on, and it's not getting passkeys. Ever. So now you're running two authentication worlds side by side, and the security of the whole thing is the security of the weaker one. Passkeys don't fix the app that still accepts "Password123!"

None of this is an argument against passkeys. It's an argument for honesty about the work. The industry spent years treating the cryptography as the finish line. It was the starting line. The real project is migration: recovery flows, cross-device stories, helpdesk training, user communication, and the long tail of systems that will never support any of this.

For users, though? It's already better. My mother will never understand what a passkey is, and she doesn't have to. She touches the fingerprint sensor and she's in. That's the victory. We spent decades building authentication that required users to think like security engineers. Finally, we built one that just requires them to be a person with a face.

The future arrived quietly. Now comes the paperwork.

The 2025 Security Budget Conversation

It's budget season, which means somewhere right now a CISO is building a slide deck full of breach headlines, red arrows, and the words "threat landscape" in 48-point font.

My advice: delete the deck.

I've sat on both sides of the budget table, and I can tell you the fear pitch stopped working a while ago. Not because the threats aren't real — they are — but because the room is already scared. The CFO reads the same headlines you do. The board has already done the tabletop exercise. Fear gets you the meeting. It doesn't get you the money.

What gets you the money is the same thing that gets anyone the money: a clear explanation of what it buys, what it costs, and what happens without it — in terms the business actually uses.

That last part is where most security leaders lose the room. We walk in speaking in vulnerabilities and they hear static. Try this instead: don't ask for a WAF. Ask for the thing the WAF protects, priced in the language of the P&L. "Our checkout flow processes X dollars per hour. This control costs Y per year and closes the most likely path to taking it offline." That's a conversation a CFO can have. "Advanced persistent threats are evolving" is not.

And here's the move that builds real credibility: bring your cut list.

Every security program has spending that made sense three years ago and doesn't now. The tool nobody logs into. The feed nobody reads. The consultant engagement that quietly became a subscription to nothing. Walk in with the things you'd cut, and two things happen. First, you prove you're a steward of the money, not just a spender of it. Second, you get to redirect those dollars to the thing you actually need, which is a much easier ask than new money.

Finance people love this. It signals that you think like an operator, not a doomsayer. And honestly, most of us could cut ten percent of our program without changing our risk posture at all. We just don't, because cutting things feels like admitting we were wrong to buy them. Get over it. The threat changed; the budget should too.

The other shift worth making: stop selling security as insurance and start selling it as enablement. Insurance is a grudge purchase — everyone resents paying for it and hopes they never use it. Enablement is different. "This investment lets us launch in the EU without a six-month compliance scramble" is a growth conversation. "This lets the sales team answer the security questionnaire in a day instead of three weeks" is a revenue conversation. You're not overhead. You're the reason the deal closes.

I know some of you are thinking: but my leadership only responds to fear. Maybe. Some cultures run on it. But even there, I'd argue the fear pitch has diminishing returns, because every year the scariest headline gets scarier and the budget stays flat. At some point you're just the person who cries breach, and the room stops flinching.

The security leaders who win budget in a cost-conscious year aren't the loudest. They're the clearest. They know what everything costs, what everything protects, and what they'd cut first. They speak in dollars and outcomes, not acronyms and anxiety.

Nobody ever got a budget approved by being the scariest person in the room.