UK NCSC: Passkey Shift Rewrites Decades of Security Practice

The UK's National Cyber Security Centre (NCSC) has described the shift to passkeys as a task that changes decades-old security practices, according to TechRadar, which reported the characterization on 13 October.

Passkeys replace passwords with credentials that are cryptographically tied to a specific domain, a design that makes them resistant to phishing. The private keys stay on the user's device and are not shared with central servers or applications, so no centralized password database is needed.

Adoption remains uneven. Among companies with a weak or non-existent identity and access management (IAM) strategy, only 30% have adopted password alternatives, and in the UK only 17% of respondents said they fully trust the organizations managing their identity data.

The push comes as AI changes the threat landscape: attackers have automated large-scale credential-stuffing attacks and sophisticated phishing, and agentic ransomware attacks have appeared, making it harder for human-centered defenses to keep pace.

Autonomous AI systems cannot remember passwords as humans do, which leads to credentials being embedded directly in code or session tokens being shared across systems — a gap passkeys are positioned to address.