An employee leaves the company. Their business laptop is returned, the user account is deactivated and access rights are revoked. But what happens to passkeys that were synchronised via private devices or personal cloud accounts? And who ensures that passwords still in use, shared accounts and recovery information remain protected?

Questions like these show that modern authentication goes far beyond the actual sign-in process. While passkeys reduce certain security risks associated with traditional passwords, they create new requirements for companies when it comes to organising and controlling digital access.

The challenge, therefore, is not choosing between passkeys and password managers, but integrating both sensibly into a secure access strategy.

Passkeys change how we sign in – but not the entire security concept

Traditional passwords have accompanied businesses for decades. They provide access to applications, cloud services and internal systems. At the same time, stolen, reused or insecurely stored passwords are among the best-known security risks.

Passkeys offer a modern approach to this problem. Instead of a traditional password, they use cryptographic key pairs. The public key is stored with the respective service, while the private key remains protected on the authenticator being used.

Sign-in is approved, for example, with a fingerprint, facial recognition or a device PIN. The actual secret never has to be transmitted to the online service.

A key advantage is their resistance to phishing. Passkeys are bound to the respective service and therefore cannot simply be intercepted and reused on a fake login page.

However, a secure sign-in does not automatically mean that all access within a company is securely organised.

Passkeys primarily answer the question of how a user authenticates with a service. What information that user can subsequently view or edit is still determined by the relevant permissions.

When secure login becomes an organisational challenge

In everyday private life, passkeys can be particularly convenient. Depending on the provider, they can be synchronised across multiple devices and allow sign-in without entering a password manually.

In a business environment, however, additional factors come into play.

Business passkeys may be stored on company-owned or private devices. Some are permanently bound to a specific authenticator, while others are synchronised in encrypted form between several devices.

This raises a crucial question: How much control does the company have over the sign-in methods being used?

If business passkeys are managed via private accounts, device changes, recovery procedures or employee departures, for example, can become harder to control.

With synchronised passkeys, it is also not always fully clear in every environment which devices hold copies. Companies should therefore define which devices and providers are approved for business access.

At the same time, procedures must be in place to revoke registered passkeys with the respective services. This prevents a sign-in method that is no longer approved from continuing to be used for the account in question.

Device loss, staff changes and offboarding: who keeps track?

A lost smartphone or a damaged laptop must not leave employees permanently locked out of business-critical applications.

Equally, account recovery must not become a security gap.

If a company uses strong passkeys but verifies identity only inadequately during account recovery, attackers may try to exploit this alternative route.

That is why secure recovery procedures are just as much a part of introducing passkeys as the registration itself.

A well-defined offboarding process is also particularly important.

When an employee is removed from the central identity system, the associated access can be blocked. However, not all applications, separately created accounts or shared accounts are necessarily connected to this system.

Companies must therefore also check whether additional sign-in methods need to be revoked, active sessions terminated, permissions removed or shared passwords changed.

The same applies to internal role changes. Anyone who takes on new tasks within the company should receive only the access rights required for them.

Passkeys improve authentication. Structured permission and access management nevertheless remains indispensable.

Why professional password management is still necessary

The growing adoption of passkeys does not mean that traditional passwords will disappear any time soon.

Numerous business applications, legacy IT systems and specialised software solutions still rely on a username and password. On top of that come shared business accounts, technical accounts and recovery information.

Companies will therefore continue to manage different types of credentials side by side for quite some time.

This is exactly where a professional password manager for businesses remains relevant.

Instead of storing passwords in Excel files, personal notes or private browser profiles, central password management makes it possible to provide business credentials in a protected and structured way.

Modern business solutions support this with features such as organisation by teams and departments, role-based access rights and the controlled sharing of required passwords.

This reduces dependence on individual employees and makes it easier to manage shared accounts.

IT administration benefits too: access permissions can be organised more transparently, and shares can be adjusted in a targeted way when staff changes occur.

Password management is therefore not just a technical safeguard, but also an important component of efficient business processes.

That said, a password manager replaces neither a complete identity and access management system nor the management of business devices. These systems complement each other within a comprehensive security strategy.

Passkeys and password managers: complementary, not competing

The debate about passwordless authentication sometimes gives the impression that password managers will become obsolete in the future.

In day-to-day business practice, this view falls short.

Passkeys solve certain problems of traditional password-based sign-in. Password managers, on the other hand, help companies securely organise the passwords and business access information they still need.

The two approaches therefore fulfil different tasks.

While passkeys secure the sign-in process for supported services, professional password management provides a structured foundation for managing existing access.

Depending on the solution, modern password managers can also support the storage and use of passkeys. However, this feature is not available from every provider.

For companies, the decisive factor is therefore not abolishing all passwords as quickly as possible. Far more important is an access strategy that takes into account both existing applications and new authentication methods.

Five measures for secure access management

Companies do not have to switch their existing IT infrastructure completely to passkeys overnight. A step-by-step approach reduces organisational risks and enables a controlled rollout.

The following measures provide a sound foundation:

1. Take stock of existing access: Check which applications already support passkeys and where traditional passwords are still required. Also consider technical accounts and shared accounts.
2. Define clear device policies: Specify whether business passkeys may be stored on private devices, which providers are approved and when device-bound passkeys are required.
3. Regulate recovery and offboarding: Define binding processes for device loss, account recovery, role changes and employee departures. Review alternative sign-in methods as part of this.
4. Organise password management centrally: Make sure that passwords still in use are stored securely, shared in a controlled manner and managed reliably when staff changes occur.
5. Review the rollout step by step: Start with suitable user groups and check regularly whether sign-in procedures, permissions and security policies meet operational requirements.

Reviewing existing fallback options is just as important. If a significantly weaker sign-in method remains active alongside a passkey, this can limit the additional security gained.

Conclusion: the future belongs to controlled access management

Passkeys are an important step forward for digital security. They simplify sign-in, reduce dependence on traditional passwords and make certain forms of phishing considerably more difficult.

For companies, however, the real challenge lies not only in introducing new technologies. What matters is that business access can be managed in a controlled way, independently of individual devices, employees or sign-in methods.

Professional password management remains an important part of IT security. As long as traditional passwords, shared accounts and other sensitive access information exist, companies need clear rules for how they are stored, used and shared.

Passkeys and password managers should therefore not be seen as opposites. Together with identity management, device management and consistent permission concepts, they form important building blocks of secure corporate IT.

With PassSecurium, companies can manage the passwords and business access they still need centrally and securely. Role-based permissions and controlled sharing support structured password management – even during the gradual introduction of modern authentication methods.