Weak can’t enroll StrongUser Assurance in the age of passkeys

Passkeys are often presented as the silver bullet for phishing-resistant authentication. In practice, though, most organisations do not get breached through their strongest path. They get breached through the weaker path that still exists beside it.

This presentation looks at what really happens when organisations try to introduce stronger credentials into customer-facing environments, especially where identity is uncertain, devices are unmanaged, and users behave inconsistently. It argues that the real challenge is not just making logins stronger. It is making sure weak enrolment, weak recovery, and weak fallback paths do not quietly undermine the result.

The talk introduces two core paradoxes. The first is that no path can be a downgrade path: if password plus SMS or email remains available as an easier route, attackers will choose it, regardless of how strong the passkey path is. The second is that weak can’t enroll strong: a credential is only as trustworthy as the session and signals that created it.

From there, the presentation explores how passkeys, push authentication, assurance signals, federation, and identity verification should work together rather than compete. The focus is not on any one vendor or product, but on the practical security model underneath: how assurance is built, how it degrades, and how it is recalibrated over time.

A distinctive part of this session is its storytelling format. Rather than staying at the level of theory, the talk walks the audience through a user-journey narrative involving multiple personas over time. Through legitimate users, messy-but-real users, and fraudulent actors, the audience sees how trust changes across onboarding, authentication, account change, phishing attempts, device loss, recovery, and escalation. This narrative format is designed to make abstract identity concepts concrete, memorable, and operationally real.

The session is aimed at security leaders, architects, identity practitioners, fraud teams, and digital product owners who are grappling with passkey adoption and modern authentication strategy. Attendees will leave with a clearer way to think about assurance, a better understanding of where stronger credentials succeed or fail in the real world, and a more realistic model for introducing passkeys without leaving weaker paths behind.