Client Portal
Passwords are the weakest part of almost every business we look at. Not because anyone is careless, but because the design asks something unreasonable of people: invent dozens of long, unique, meaningless strings, never write them down, never reuse one, and correctly tell a real login page from a very good copy of it while you are busy. Nobody manages that. Passkeys are the technology built to stop asking.
What makes them unusual is that they are the rare security improvement that also makes life quicker. Most of what we recommend adds a step. This removes one.
What a passkey actually is
A passkey lets you sign in with whatever already unlocks your device: a fingerprint, a face scan, or the PIN you use on your phone. No password is typed, because none exists.
Underneath, setting one up creates a matched pair of cryptographic keys. The private one is locked into your device and never leaves it, not when you sign in, not ever. The public one is handed to the website, which is welcome to it, because on its own it is useless. When you come back to log in, the site poses a mathematical question that only the private key can answer. Your device answers it the moment you confirm with your fingerprint, and you are in. This is a published standard called FIDO, which Apple, Google and Microsoft have all built into their platforms.
A password is a secret you hand to a website every single time you sign in. A passkey never leaves your device at all.
Why they cannot be phished
This is the part worth understanding, because it is not a matter of degree. A passkey is cryptographically bound to the real website it was created for. Put a user in front of a flawless replica of the Microsoft 365 login page and the passkey will simply refuse to work. There is no judgement call, no moment where a tired person squints at a domain name and decides it looks close enough. There is nothing to hand over.
Compare that with how most break-ins actually begin. A convincing email, or a QR code on a poster that leads somewhere it should not, as we wrote about in quishing, the QR code scam your email filter cannot see. Every one of those attacks depends on a person typing a secret into the wrong box. Take away the secret and the attack has nothing to collect.
Two more things follow from the same design. There is no password list to steal when a vendor is breached, because the vendor never held one. And passkeys are generated per site, automatically, so reused and recycled passwords stop being a category of problem.
It is also worth being blunt about the multi-factor authentication most businesses are running today. SMS codes can be intercepted or socially engineered out of someone on the phone. Push approvals can be spammed at midnight until a half-asleep person taps yes. Both are far better than nothing. Neither is phishing-resistant.
The Essential Eight has already moved on this
This is the part most of the international coverage misses, and it matters more to an Australian business than anything else on this page.
The Australian Signals Directorate and the ACSC updated the Essential Eight so that Maturity Level 2 requires phishing-resistant multi-factor authentication for privileged user accounts, sensitive data repositories, and actions that use elevated privileges. In the same movement, SMS codes and ordinary Authenticator push approvals are treated as legacy methods rather than the standard to aim at.
So if you are working toward the Essential Eight, or a customer or insurer has started asking harder questions about how your administrators sign in, passkeys are not a speculative upgrade. They are the direction the guidance has already taken. It is the same reason the multi-factor question keeps appearing on cyber insurance renewal forms, and the answers there are getting more specific each year.
Phishing-resistant sign-in is no longer the gold standard. For privileged accounts under Essential Eight Maturity Level 2, it is the baseline.
Where passkeys already work
Further than most people assume. Microsoft, Google and Apple accounts all accept them, alongside a lengthening list of banks, password managers and business applications. The phone in your pocket and the laptop on your desk can already store and use them, because support is built into the operating systems and browsers rather than bolted on.
There are two flavours, and the difference matters when you plan a rollout.
- Synced passkeys are backed up to your Microsoft, Apple or Google account. They follow you across your devices, and losing a phone is an inconvenience rather than a crisis.
- Device-bound passkeys live on one device only, such as a hardware security key you carry on a keyring. This is the most locked-down option, and the usual choice for administrator and finance accounts.
If you run Microsoft 365, you already have this
Passkeys are available through Microsoft Entra at no extra cost, including on the free tier. Your team can hold a passkey in the Microsoft Authenticator app, on a security key, or on the device itself via Windows Hello, Face ID or Touch ID. Google Workspace supports them too. For most of our clients this is a configuration change and a rollout plan, not a purchase.
Microsoft's own figures put a synced passkey sign-in at roughly three seconds, against about sixty-nine seconds for a password plus a traditional multi-factor code. That is fourteen times faster. Spread across every person in the business, every day, for a year, it stops being a rounding error. It is not often that the safer option is also the one your staff will thank you for.
How to roll them out without locking anyone out
The technology is the easy half. Almost every passkey rollout that goes badly goes badly for the same handful of reasons, so plan for these.
- Start where an attacker would. Administrators, finance, and anyone who can move money or change systems. That is also precisely the group Essential Eight Maturity Level 2 names.
- Let everyone else opt in alongside their existing login. There is no need for a big-bang cutover, and there is no prize for one.
- Register a backup before anyone needs it. A second device, or a security key in a drawer. The lockout stories almost always trace back to a single registered device and no plan.
- Turn the weak fallback off. This is the step people miss. If SMS codes remain enabled as a backup, an attacker will simply choose the backup, and you have bought yourself very little. Phishing-resistant only means something when the phishable route is closed.
- Deal with shared devices and shared logins. A passkey belongs to a person and a device. Shared accounts need their own plan, and in most cases they need to stop existing.
What to watch out for
Passkeys are not magic, and it would be a poor advertisement for us to pretend otherwise.
Account recovery is the real one. Someone who loses their only registered device, with no backup, is going to have a bad morning and so is whoever supports them. Synced passkeys and a second registered device solve it, but only if you set that up in advance.
Coverage is still uneven. The major platforms are there, but plenty of older line-of-business systems and smaller vendors have not arrived yet, so you will run passwords alongside passkeys for a while. That is fine. It is not a reason to delay protecting the accounts that matter most.
Where we land on this
For most businesses across Melbourne and the Mornington Peninsula, the answer is yes, and the answer is start small. Not everything, not overnight. Turn passkeys on for the handful of accounts that would do the most damage in the wrong hands, register the backups properly, close the weak fallback, and let the rest of the business adopt them because they are faster.
That last part is genuinely unusual in cyber security. Most of what we ask people to do costs them a few seconds and some patience. This one gives the seconds back. If you would like it switched on properly, that is the sort of work AgileSECURE exists to do, and if you are earlier in the journey the cyber security basics are the right place to start.