Passkeys for your staff, not just customers
Most phishing that works today gets past passwords and push MFA. Passkeys on staff accounts stop it.
Today is World Password Day, so here’s my one suggestion: move your own staff to passkeys.
The breaches of the past few months mostly started the same way: a fake login page or a convincing phone call, a password typed in, an MFA push approved or an SMS code read out. Passkeys don’t work on a fake site, and there’s no code to read out.
Where to start:
- Admins and IT staff first, then finance, HR and anyone with access to customer data.
- Turn on passkey or security key sign-in in Microsoft Entra, Google Workspace or Okta. They all support it now.
- Register two per person: one on the laptop or phone, one hardware key as backup.
- Once a group is enrolled, remove SMS and push as fallback options for them.
- Fix the help desk process for lost devices, so it can’t be talked around.