Digital Identity, Authentication, and the Post-Password Web: A 2026 Guide for New CTOs

Microsoft made passkeys the default sign-in method in Entra ID in September, forcing millions of tenants to migrate, while Entrust recorded one deepfake identity attack every five minutes—a 2000% surge—and LexisNexis reported a 180% rise in synthetic identity fraud, with one in every 100 failed identity checks now carrying a deepfake. The UK government scrapped its BritCard national digital ID scheme in July, and OWASP published a Non-Human Identities Top 10 and NIST launched its AI Agent Standards Initiative as machine identities outnumber human ones by up to 109:1.

Digital identity is fracturing along four fault lines. In July, the UK government scrapped its BritCard national digital ID scheme https://www.bbc.com/news/articles/c5y08z25q8eo under PM Burnham, walking away from top-down identity provision. In September, Microsoft made passkeys the default sign-in method https://www.microsoft.com/en-us/security/blog/2026/07/13/microsoft-entra-id-security-updates-passkeys-are-the-default-authentication-method-in-entra-id/ in Entra ID, forcing a migration decision onto millions of tenants. Around the same time, Entrust recorded one deepfake identity attack every five minutes https://truescreen.io/articles/deepfake-complete-guide/ — a 2000% surge — while LexisNexis reported a 180% rise in synthetic identity fraud https://risk.lexisnexis.com/about-us/press-room/press-release/20260714-ai-deepfakes , with one in every 100 failed identity checks now carrying a deepfake. And non-human machine identities now outnumber human ones by anywhere from 50:1 to 109:1, which is why OWASP published a Non-Human Identities Top 10 https://cloudsecurityalliance.org/blog/2026/04/23/we-are-fixing-the-wrong-problem-in-non-human-identity-security and NIST launched its AI Agent Standards Initiative https://www.nist.gov/caisi/ai-agent-standards-initiative . The through-line is straightforward. Authentication is moving past passwords, but the threat surface is moving with it. Credential phishing has turned into token theft. AI now clears liveness checks and full onboarding flows without a human in the loop. And most of the identities in your estate are machines nobody owns. Token theft sits under the authentication fault line alongside the Microsoft mandate, which is why that fault line spans three of the five articles below. This hub maps that landscape. Each section below covers one fault line and links to the full article — from the passkey foundations /how-passkeys-work-and-the-real-security-difference-from-passwords through the Entra ID migration decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision — so you can evaluate the options and decide your next move without reading everything end to end. In This Series How Passkeys Work and the Real Security Difference From Passwords /how-passkeys-work-and-the-real-security-difference-from-passwords — The foundational explainer on the FIDO2/WebAuthn credential model and why it resists phishing. Why Microsoft Is Retiring SMS Authentication and Token Theft Defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa — The news-driven forcing function and the threat rationale behind it. Passkeys vs SMS MFA and the Entra ID Migration Decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision — The decision piece that follows the mandate. How AI Is Changing Identity Fraud and What Defences Actually Work /how-ai-is-changing-identity-fraud-and-what-defences-actually-work — The AI-fraud attack front and the countermeasures that hold up. Non-Human Identities Explained and the Identity Governance Vacuum /non-human-identities-explained-and-the-identity-governance-vacuum — The capstone backgrounder on machine identity and government retreat. What are passkeys and how do they differ from passwords and traditional MFA? A passkey is a FIDO2/WebAuthn credential pair. A private key stays on your device or sync provider, and the public key sits with the service. Signing in is a cryptographic challenge-response, so there is no shared secret to steal, reuse, or phish. Passwords are human-chosen, reusable, and breachable at the server. SMS and authenticator codes are one-time secrets that can still be relayed. The real difference is that a passkey only works on the origin where it was registered. Passkeys are built on FIDO2 and WebAuthn, the open standards run by the FIDO Alliance, and their availability is driven by the browser and operating system layer. Google, Chrome, and Android sit on one side; Apple’s ecosystem sits on the other. The mechanism stays simple at the top level: the private key never leaves the device, the public key is stored by the relying party, and you unlock it with a biometric or a PIN. That is the whole model, and it is enough to understand the security argument without a single line of enrolment code. The practical question is what actually changes when you stop using a shared secret. There is no server-side password database left to breach, no reusable credential to relay, and no user-typed secret to capture. Microsoft’s own telemetry https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 puts synced passkey sign-ins at around three seconds, versus roughly 69 seconds for a password plus traditional MFA, which tells you the convenience and security arguments point the same way. This is the baseline every other section builds on, so start with how passkeys work and why they resist phishing /how-passkeys-work-and-the-real-security-difference-from-passwords for the full explainer. What is phishing-resistant authentication and why does it matter now? Phishing-resistant authentication cryptographically binds a credential to the domain it was registered for and requires local user presence through a biometric or PIN. A lookalike site cannot replay a reusable secret, and an adversary-in-the-middle proxy cannot relay the second factor. It matters now because credential phishing and relay attacks are the dominant initial-access vector, and phishable methods such as SMS, voice, and push OTP still let attackers proxy a live login. Origin binding is the mechanism that separates passkeys and FIDO2 security keys from everything else. The FIDO Alliance https://fidoalliance.org/ defines the property, and it works because the credential will only complete authentication at the correct domain. One-time codes fail here precisely because they are human-entered values with no cryptographic binding to the destination. A code is a code no matter which site you type it into, and that is the gap attackers keep walking through. The urgency is economic: adversary-in-the-middle tooling now proxies a live session instead of harvesting passwords, so the attacker never even needs your secret. Tycoon 2FA, a single phishing-as-a-service platform, accounted for 62% of the phishing volume Microsoft blocked https://workos.com/blog/passkeys-stop-ai-phishing-mfa-fallbacks by mid-2025. And any phishable fallback you leave active becomes the weakest link in the chain, which is exactly the problem the attacks defeating MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa article tackles next. The credential model that enforces this binding is the passkey foundation, so how passkeys work and why they resist phishing /how-passkeys-work-and-the-real-security-difference-from-passwords is where to start. Why is Microsoft making passkeys the default and retiring SMS and voice authentication? Microsoft is making passkeys the default in Entra ID because phishing-resistant credentials cut account takeover at its source, while SMS and voice codes remain structurally phishable through SIM swap, interception, OTP relay, and help-desk social engineering. The change is a default-behaviour shift, not an immediate universal cutover, and it carries a defined retirement timeline with an opt-out window. For you, it converts passkey adoption from an aspiration into a dated planning obligation. From 1 September 2026, Microsoft automatically enables passkeys for users who currently rely on SMS or voice. The rationale is simple: phishing resistance by default, and a reduction in account takeover. But the operational meaning for you is narrower than a universal cutover. This changes what happens by default. Every tenant gets a window to sequence the work before it becomes a blocking prompt. The timeline is what turns the announcement into a plan. Microsoft retires its native SMS and voice authentication services entirely on 1 February 2027 https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sms-voice-retirement , with a temporary opt-out available through a Microsoft Graph setting in the interim. After that date, users whose only available method is SMS or voice must register a passkey before they can keep signing in. Forrester calls the change an inflection point https://www.forrester.com/blogs/microsoft-makes-passkeys-default-what-identity-and-security-leaders-need-to-do/ and argues success should be measured by the share of users protected by phishing-resistant methods. The full article on why Microsoft is retiring SMS authentication and how token theft defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa carries the timeline, the citations, and the threat rationale. Why does token theft still defeat MFA even when passkeys are in place? Passkeys protect the login moment. They do not protect the session that follows. Once a user authenticates, the issued OAuth token or session cookie becomes the credential, and stealing it bypasses every earlier factor. The FBI-flagged Kali365 phishing kit does exactly this: the victim signs in, MFA included, but the attacker intercepts the token response and walks away with persistent access. Device Bound Session Credentials DBSC https://developer.chrome.com/blog/io26-web-identity are the emerging countermeasure that binds sessions to the device. There is a hard boundary between the authentication layer and the authorisation layer. Passkeys fix credential phishing. They do not stop an attacker who captures the token issued after a successful login. Kali365 https://www.ic3.gov/PSA/2026/PSA260521 , distributed over Telegram, uses a device-code flow to capture OAuth access and refresh tokens without ever intercepting a password. The MFA is satisfied, and the session is still hijacked. The implication for your defences is useful to keep in view. Authentication strength does not bind the session credential that follows it. A stolen session cookie carries the completed MFA claim with it, so replaying it grants full access with no second prompt. DBSC is the emerging response, binding sessions to hardware so a stolen cookie cannot be replayed from another device, but it is not universal yet. The mechanics are worth understanding, so dig into the token-theft and session-hijacking analysis /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa for the full threat breakdown. Passkeys vs SMS/OTP MFA: which should enterprise authentication standardise on? Standardise on phishing-resistant passkeys or FIDO2 security keys as the default, and treat SMS/OTP as a legacy interim fallback at best. Passkeys win on security and typically on sign-in speed and reliability. SMS/OTP survives mainly for constrained or legacy cohorts during transition. The deciding criteria are phishing resistance, user experience, recovery, and admin overhead, rather than vendor familiarity. Your goal is a single phishing-resistant default with no permanently active phishable path. The comparison is a trade-off exercise across four axes. Security is the easy one: passkeys are phishing-resistant, SMS and OTP are not. Sign-in friction also favours passkeys, at roughly three seconds versus 69 seconds for password plus MFA. Recovery and admin overhead are where it gets interesting, because synced passkeys shift recovery onto a cloud account while hardware keys add provisioning and support cost. These four trade-offs are the decision surface that matters. The strategic direction follows from that. Run a phishing-resistant default and demote SMS/OTP to a time-boxed transition fallback that you plan to remove. A permanently active phishable path gives attackers a way around the stronger method. The real security difference between passkeys and passwords /how-passkeys-work-and-the-real-security-difference-from-passwords sets the baseline, why SMS authentication is being retired /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa supplies the forcing function, and the Entra ID passkey migration decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision turns the comparison into a plan. How should you evaluate migrating to passkeys now versus using Microsoft’s temporary opt-out? Evaluate against your current authentication estate, device and BYOD posture, the volume of users still on SMS or voice, support capacity, and proximity to the retirement deadline. The opt-out only pauses the rollout, so use it to sequence work rather than defer it. Baseline your SMS/voice users to size the effort, verify any narrow exception for a customer-managed telecom provider, and treat the Microsoft Graph opt-out setting as a scheduling lever. The migrate-now-versus-opt-out question is really a sequencing question. Can your business absorb the change now, or do you need the opt-out to stage it? The first step is to establish a baseline of users still on SMS or voice. Microsoft ships a PowerShell script for identifying users still on SMS or voice, and it turns an abstract mandate into a sized plan. Without that number you are guessing at effort. Forrester recommends the same starting point and frames the announcement as an inflection point for phishing-resistant adoption. The opt-out itself lives in a tenant-wide Microsoft Graph property rather than a portal toggle, and it only pauses the rollout during the September 2026 to February 2027 window. It buys you time to sequence the work. For cohort prioritisation and the build-versus-buy depth, the full migration decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision is the full treatment. Synced, device-bound, or FIDO2 hardware key: which passkey type should you choose? Choose by threat model and portability rather than a one-size rule. Synced passkeys suit most users, with recovery via a cloud account at the cost of cloud-account compromise risk. Device-bound passkeys offer stronger isolation but weaker portability and recovery. FIDO2 hardware keys deliver the highest assurance, with physical possession required and higher lifecycle cost. The Canadian Centre for Cyber Security’s ITSAP.30.033 guidance is the authoritative reference for matching the type to assurance needs. The three options sit on a convenience-versus-assurance spectrum. Synced passkeys live in platform clouds such as Apple iCloud Keychain or Google Password Manager, which makes recovery easy but ties the credential to a cloud account. Device-bound passkeys never leave the device’s secure hardware, which is stronger isolation but means you lose access when the device is lost. FIDO2 hardware keys are physical tokens with the strongest isolation and the heaviest lifecycle burden, from provisioning to help-desk support. Selection should follow your threat model and workforce portability rather than a universal recommendation. Most of your users are fine on synced passkeys. Privileged and regulated roles may justify device-bound or hardware keys, especially where NIST AAL3-style assurance https://www.sentinelone.com/cybersecurity-101/identity-security/phishing-resistant-mfa/ applies. The Canadian Centre for Cyber Security’s ITSAP.30.033 https://www.cyber.gc.ca/en/guidance/cyber-security-considerations-passkeys-itsap30033 guidance is the authoritative reference here, and the passkey foundation explainer /how-passkeys-work-and-the-real-security-difference-from-passwords walks through the full trade-off. How is AI changing synthetic identity fraud and deepfake identity attacks? AI is lowering the cost and raising the volume of fraud. Synthetic identity fraud stitches real and fake data into identities that build trust before a bust-out, with no human victim to complain; LexisNexis reports a 180% rise. Deepfake attacks use AI-generated faces and voices against remote onboarding and video KYC — Entrust recorded one every five minutes, a 2000% surge. Fraud-as-a-service and autonomous AI agents now clear liveness checks and full onboarding flows without human intervention. Synthetic identity fraud is hard to detect for a structural reason: there is no single human victim to report it. A fraudster combines a valid identifier with fabricated details, then lets the identity mature before cashing out. LexisNexis reports a 180% year-on-year rise in synthetic identity fraud, with one in every 100 failed identity checks now carrying a deepfake, and businesses lose an estimated $20bn to $40bn a year https://fintech.global/2026/03/20/how-ai-and-deepfakes-are-reshaping-identity-fraud-in-2026/ to the problem globally. The manual control that once caught this, a human liveness check at onboarding, is no longer reliable against what AI can now produce. Deepfakes have grown along the same curve. Deepfake images and cloned voices now sell for a few dollars, and deepfake-as-a-service bundles the whole pipeline, so the barrier to entry has dropped for attackers who would never have attempted this before. This section stays at the level of what is changing; the article on how AI is changing identity fraud and which defences actually work /how-ai-is-changing-identity-fraud-and-what-defences-actually-work carries the vendor evaluation and the layered defences that hold up. What are non-human identities and why do they now outnumber human identities? Non-human identities are credentials assigned to software rather than people: API keys, service accounts, OAuth tokens, workload identities, bots, and CI/CD pipelines. They outnumber humans by 50:1 to 109:1 in many organisations because microservices, cloud, and automation multiply machine credentials far faster than headcount grows. Most are unowned, over-privileged, and rarely rotated, which is why OWASP published a dedicated Non-Human Identities Top 10. The outnumbering ratio is a function of how modern software is built. Every microservice, cloud resource, and pipeline stage creates credentials, and automation compounds them. Analysts differ on the exact number depending on the environment, but the direction is unanimous. These are token-based identities, so they share the same theft dynamics covered in token theft and session security /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa . A stolen service-account token is a stolen session. The governance gap is the real problem. OWASP’s Non-Human Identities Top 10 is the cataloguing framework, but discovery alone does not fix anything. The deeper issue is ownership and lifecycle: most service accounts have no owner, no expiry, and more privilege than they need. Half of surveyed organisations in CyberArk’s 2025 machine-identity report https://www.cerbos.dev/blog/non-human-identity-management-has-a-blind-spot tied a breach in the past year to a compromised machine identity. For the governance starting point and the BritCard context, read non-human identities and the governance vacuum /non-human-identities-explained-and-the-identity-governance-vacuum . Why did the UK government scrap BritCard, and what does the retreat signal? The UK scrapped its BritCard national digital ID scheme in July under PM Burnham, retreating from top-down, centralised identity provision amid privacy, political, and technical friction. The collapse signals that centralised government identity is not the default path. Attention is shifting to decentralised digital credentials and verifiable credentials with selective disclosure. For you, it means private-sector identity strategy cannot simply wait for a national ID to solve verification. The scrapping itself was a collision of forces. Nearly three million people signed a parliamentary petition opposing digital IDs, and the programme was estimated to cost £1.8bn over three years before it was scrapped. The political and privacy objections merged with the technical and cost friction of a single national scheme, and the result was a retreat rather than a relaunch. The strategic signal matters more than the policy history. The retreat from centralised identity contrasts with the emerging decentralised model of digital credentials and verifiable credentials, where you disclose only the attribute required rather than your full identity. The EU’s Digital Identity Wallet and the browser-level Digital Credentials API both point that direction. Treat the episode as one edge of the same fracturing identity landscape this hub maps, covered in the machine-identity governance backgrounder /non-human-identities-explained-and-the-identity-governance-vacuum . Resource Hub: The Post-Password Identity Landscape Foundations and the Forcing Function How Passkeys Work and the Real Security Difference From Passwords /how-passkeys-work-and-the-real-security-difference-from-passwords — The FIDO2/WebAuthn credential model, phishing resistance, and the synced/device-bound/hardware-key choice. Why Microsoft Is Retiring SMS Authentication and Token Theft Defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa — The Entra ID default change, the SMS/voice retirement timeline, and why token theft still beats strong MFA. The Migration Decision Passkeys vs SMS MFA and the Entra ID Migration Decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision — The standardisation choice, migrate-now-versus-opt-out evaluation, cohort prioritisation, and build-vs-buy for a 50–500 person company. The Wider Identity Estate How AI Is Changing Identity Fraud and What Defences Actually Work /how-ai-is-changing-identity-fraud-and-what-defences-actually-work — Synthetic identity fraud, deepfake growth, vendor evaluation, and why liveness needs layered defences. Non-Human Identities Explained and the Identity Governance Vacuum /non-human-identities-explained-and-the-identity-governance-vacuum — Machine identities at 50:1 to 109:1 scale, how to start governing them, and the BritCard retreat. Suggested reading order: Start with the passkey foundations, follow the mandate → decision pair, then widen the frame to fraud and machine identity. You can also enter at any fault line matching your immediate problem. Frequently Asked Questions Do passkeys eliminate the need for MFA entirely? No. Passkeys protect the login moment. Token and session-cookie theft can still defeat them after that, so device-bound session credentials and conditional access stay relevant. See Why Microsoft Is Retiring SMS Authentication and Token Theft Defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa . What is the difference between synthetic identity fraud, account takeover, and deepfake impersonation? Synthetic identity fraud fabricates a new identity from real and fake data. Account takeover seizes an existing account. Deepfake impersonation uses AI-generated face or voice to pose as a real person. They often combine, with deepfakes clearing onboarding checks for synthetic identities. See How AI Is Changing Identity Fraud and What Defences Actually Work /how-ai-is-changing-identity-fraud-and-what-defences-actually-work . How do passkeys, MFA, and OAuth token security compare for enterprise authentication? They protect different layers. Passkeys and MFA secure the login moment; OAuth token security governs what happens after. Phishing-resistant passkeys beat phishable MFA at login, but neither stops token theft once a session is issued. See How Passkeys Work and the Real Security Difference From Passwords /how-passkeys-work-and-the-real-security-difference-from-passwords and Why Microsoft Is Retiring SMS Authentication and Token Theft Defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa . Should a 50–500 person company build or buy its identity infrastructure? For workforce identity, buy a managed IdP such as Entra ID — passkeys are an IdP feature, not a separate build. Reserve custom build for product-user authentication, where your requirements genuinely diverge. See Passkeys vs SMS MFA and the Entra ID Migration Decision /passkeys-vs-sms-mfa-and-the-entra-id-migration-decision . Where can I find Microsoft’s official documentation on the Entra ID SMS and voice retirement? Microsoft’s Entra ID documentation sets out the September passkey-default change, the SMS/voice retirement timeline, and the opt-out mechanics. See Why Microsoft Is Retiring SMS Authentication and Token Theft Defeats MFA /why-microsoft-is-retiring-sms-authentication-and-token-theft-defeats-mfa for the timeline and citations. Where can I find the OWASP Non-Human Identities Top 10? The OWASP Non-Human Identities Top 10 catalogues the main machine-identity risks and is the starting governance framework. See Non-Human Identities Explained and the Identity Governance Vacuum /non-human-identities-explained-and-the-identity-governance-vacuum . Where can I find the Canadian Centre for Cyber Security’s passkey guidance? The Canadian Centre for Cyber Security’s ITSAP.30.033 covers passkey selection and assurance, and is the authoritative reference for choosing between synced, device-bound, and hardware keys. See How Passkeys Work and the Real Security Difference From Passwords /how-passkeys-work-and-the-real-security-difference-from-passwords . How do I assess my organisation’s exposure to synthetic identity fraud? Map where synthetic identities and deepfakes could enter — onboarding flows, KYC thresholds, account-recovery paths, and high-value actions — then weigh the regulatory exposure in FinTech and HealthTech. See How AI Is Changing Identity Fraud and What Defences Actually Work /how-ai-is-changing-identity-fraud-and-what-defences-actually-work for the strategic framework.