Ask the people paid to secure company systems how they log in at work and the most common answer is still a username and a password. In a survey of 1,890 technology and security professionals in nine countries, published by Yubico and Okta on October 7, 43 percent said that is how they log in to work accounts, even though 87 percent described themselves as familiar with passkeys. Just over half, 52 percent, had been handed a password on their first day in the job, and the authors' reading is that whatever the IT desk issues at the start becomes the habit.
The gap is not one of knowledge. Asked which option is most secure, 31 percent of respondents picked hardware passkeys, 27 percent synced passkeys and 23 percent device bound passkeys on a phone, and Yubico's own conclusion is that friction and onboarding defaults, not awareness, keep passwords in place. The finding arrives as consumer adoption has moved quickly: the FIDO Alliance estimated in May that 5 billion passkeys were in use worldwide and that 75 percent of people had enabled one on at least one account.
What a passkey is
A passkey is a FIDO credential: a pair of cryptographic keys created for one website or app. The private key stays on the user's device or security key and is unlocked with the same fingerprint, face scan or PIN that unlocks the device; the site stores only the public key and, at sign in, checks a signature over a challenge it issued. Nothing reusable crosses the wire, so there is no shared secret to phish, stuff or crack, and because the credential is bound to the real domain, a convincing lookalike page gets nothing it can use. Biometric data never leaves the device; the server learns only that the check succeeded.
The split that matters for employers is between synced and device bound passkeys. A synced passkey lives with a passkey provider, such as an operating system keychain or a password manager, and is copied, end to end encrypted, to the user's other devices, which makes recovery and new device setup painless. A device bound passkey never leaves the hardware it was created on, typically a security key, and is the form more respondents rated as the strongest than any other, at 31 percent. The trade off is between convenience and assurance: synced credentials inherit the security of the provider account, while device bound ones demand a plan for lost or broken hardware.
Why work lags behind
Several things slow adoption inside organizations that do not apply to a personal account. Older applications and network gear often cannot speak anything but a password, and recovery is the hard problem: Microsoft noted in May that account recovery flows are where attackers go when the front door is locked, and launched a recovery option for its Entra ID service based on government issued ID and face checks. Identity provider defaults matter as much as anything. Microsoft said that from September 1, 2026 it would start making passkeys the default sign in method in Entra ID, prompting users who rely on text message and voice codes to register one, and that on February 1, 2027 it would retire its own SMS and voice delivery.
The FIDO Alliance's workforce numbers from the same May report show how far along employers are: 68 percent of organizations had deployed or were deploying passkeys for employee sign in, 28 percent had reached fully passwordless authentication, and yet 57 percent still relied on phishable methods for day to day sign in. The Yubico and Okta survey adds the onboarding angle, and a national one: in the United States, 50 percent of security professionals used passwords at work, the highest share of any market surveyed despite the highest technical awareness.
Where to start
- Make the first login passwordless. The survey's sponsors argue for issuing phishing resistant authenticators during onboarding and enforcing them through application sign on policies, so that nobody has a password habit to unlearn.
- Put passkeys in front of the identity provider rather than app by app, so that single sign on carries them to hundreds of applications at once, and use registration prompts during an existing multifactor sign in, as Microsoft does in Entra ID.
- Match the passkey type to the risk. Synced passkeys suit most staff; the high value accounts that Yubico argues should sit behind a hardware security key, which requires a physical touch to approve a login, translate in a company to administrators, finance teams and executives.
- Fix recovery and fallbacks before announcing anything. A text message code left as a backup reintroduces the SIM swap risk the survey's authors warn about, and Microsoft's experience is that attackers aim at the recovery flow once the primary credential resists phishing.
The consumer side shows what happens when defaults change. Google said in May 2024 that more than 400 million of its accounts had used passkeys, over 1 billion sign ins in total, and that passkeys were already used daily more often than text message and app codes combined, and Microsoft reported a year later that nearly a million passkeys were being registered every day, with sign in success of about 98 percent against 32 percent for passwords. The survey's most telling figure may be the 52 percent who were handed a password on their first day, because that is a choice an IT department makes, not a limit of the technology.
