AI is reshaping cybercrime at an unprecedented pace. Threat actors are using it to industrialise attacks, enable highly convincing phishing campaigns, automate credit-stuffing attempts and compromise accounts at a speed and scale traditional security measures cannot defend against, says Alex Laurie, GTM CTO at the identity security product company Ping Identity.
At the heart of these traditional security measures lies passwords. The UKโs National Cyber Security Centre (NCSC) recently urged organisations to replace passwords with passkeys wherever possible. The recommendation reflects a growing consensus across the cybersecurity industry that passwords are no longer capable of providing adequate protection against todayโs identity-based attacks. With research confirming just 9pc of enterprises are actively prepared to defend against AI-driven identity threats, itโs clear a significant security gap needs to be addressed. A move to passwordless authentication is necessary for organisations seeking to safeguard digital trust.
Why passwords fail security and usability
To understand why we must move away from passwords, we must look at the friction they introduce to the enterprise. For years, identity security was treated as a back-office problem. Today, it sits at the absolute centre of customer experience and corporate revenue.
Passwords force a broken trade-off: making users create increasingly complex strings of characters results in severe password fatigue and, in many cases, account abandonment altogether.
Furthermore, public scepticism is at an all-time high. Research shows that 76% of Brits are genuinely worried about identity theft and fraud, yet only 17% fully trust the organisations managing their identity data. Passkeys directly resolve this trust deficit through cryptographic authentication. Because private keys stay securely on the user’s local device and are never shared with a central server or application, there is no central database for hackers to breach. Because passkeys are cryptographically bound to a specific, verified domain name, they are inherently phishing-resistant, completely neutralising the human error that social engineering exploits.
Securing machine identities
The case for passkeys extends beyond human convenience. As we navigate the explosive rise of agentic AI โ autonomous digital proxies, personal shoppers and synthetic workflows executing transactions and querying databases on behalf of humans โ traditional security models are becoming outdated.
The introduction of AI into security completely shatters traditional authentication models. Passwords were fundamentally built for human brains to remember. Passwords were fundamentally built for human brains to remember. An autonomous AI agent cannot “remember” a password without creating severe vulnerabilities, such as hardcoded credentials or shared session tokens that expose permanent risks. If an agent inherits over-privileged human credentials, a compromised or rogue process can exfiltrate sensitive data at machine speed โ vastly outpacing the response time of a traditional Security Operations Center.
Passkeys and decentralised, cryptographic credentials offer the only viable path forward. By giving AI agents their own distinct, first-class machine identities with task-specific, time-bound permissions, enterprises can securely verify and audit machine-to-machine actions without exposing underlying human credentials.โฏ
Whatโs holding back passkey adoption?
Despite the clear benefits, transitioning away from passwords presents real-world complexities. They remain deeply embedded within legacy architectures, core IT systems and critical compliance infrastructure. Replacing them requires careful orchestration and many IT leaders fear that updating these systems will demand massive code rewrites and extensive specialist development resources.
This is where advanced identity orchestration becomes a critical business enabler. Modern, low-code or no-code identity platforms allow organisations to visually map, test and deploy sophisticated authentication journeys seamlessly. This abstraction layer enables businesses to introduce modern passwordless options like passkeys or biometric prompts progressively, without ripping and replacing underlying legacy systems or disrupting the active user workflow.โฏ
Simultaneously, the broader industry momentum is making this shift inevitable. Tech giants like Google and Amazon are rapidly positioning passkeys as their default authentication standard. Organisations that delay moving toward passwordless frameworks are left defending a perimeter built for an entirely different era.โฏ
Securing tomorrowโs digital enterprise
The organisations best positioned to protect against future attacks are those that treat identity as the cornerstone of digital trust, rather than another layer of security. An identity-first model built around passkeys and intelligent identity orchestration enables businesses to deliver a smooth user experience, protect an expanding ecosystem of both human and non-human identities and establish the continuous trust needed to grow in a digital economy.
This is why the NCSCโs guidance is encouraging organisations to move beyond passwords wherever possible. As AI-powered attacks continue to reshape the threat landscape, relying on static authentication is no longer a viable long-term strategy.
