Enterprise Passkey Security: Beyond Phishing Resistance to Enrollment & Recovery

Passkeys have rapidly emerged as a foundational technology promising to fundamentally shift the paradigm of online authentication. Touted for their inherent phishing resistance, they represent a significant leap forward from traditional password-based systems. Yet, as enterprises increasingly adopt passkeys for their workforce and customer identities, a critical truth is coming into sharp focus: the security of passkeys is only as strong as the processes governing their enrollment and recovery.

While the cryptographic strength of WebAuthn—the underlying standard for passkeys—is robust, adversaries are not targeting the cryptographic protocol itself. Instead, they are shifting their focus to the human element and the operational workflows that facilitate passkey creation and account recovery. This nuanced attack surface demands a re-evaluation of enterprise identity and access management (IAM) and customer identity and access management (CIAM) strategies, moving beyond mere phishing resistance to a holistic security posture that encompasses the entire passkey lifecycle.

The Shift in Attack Vectors: From Phishing to Enrollment & Recovery

Traditional phishing attacks, which rely on tricking users into revealing credentials, are largely mitigated by passkeys. A passkey is cryptographically bound to the relying party (the website or service) it was created for, making it impossible to use on a fraudulent site. However, threat actors are adaptive, and their attention has now turned to exploiting weaknesses in the provisioning and management of these otherwise secure credentials.

Recent incidents highlight this evolving threat landscape:

• Vulnerability Clusters: The disclosure of a cluster of vulnerabilities in platforms like ZITADEL, particularly CVE-2026-105209, demonstrates how flaws in passkey enrollment can lead to cross-organization account takeovers by ignoring critical organizational identifiers during the enrollment process. This exposes a fundamental weakness: if the system issuing or linking the passkey can be tricked, the cryptographic strength of the passkey itself becomes irrelevant [7].
• Social Engineering at Scale: Reports indicate that passkey phishing attacks are now leading to cloud account takeovers, specifically by targeting WebAuthn enrollment and recovery flows [8]. This is not traditional phishing for passwords; it's social engineering designed to manipulate users or administrators into initiating passkey enrollment on an attacker-controlled device or linking an attacker-controlled passkey to a legitimate account.

These examples underscore a crucial point: securing passkeys requires a multi-faceted approach that extends beyond the cryptographic handshake to the entire identity lifecycle.

Why Enrollment and Recovery are Critical Weak Points

1. Human Element Exploitation: No matter how secure the underlying technology, the human element remains a primary target. Attackers leverage vishing (voice phishing) and other social engineering tactics to convince users to perform actions that compromise their accounts. This could involve tricking an employee into enrolling a new passkey on a device controlled by the attacker or authorizing a recovery process that grants unauthorized access.

2. Implementation Flaws: The robustness of passkeys depends heavily on correct implementation by relying parties. As seen with the ZITADEL vulnerabilities, logic flaws in how an identity provider (IdP) verifies identity during enrollment or recovery can create severe vulnerabilities. These flaws can permit an attacker, with minimal prior access or information, to inject their own passkey into a victim's account or reset access in their favor. This highlights the risk of insecure direct object references or insufficient authorization checks during critical identity operations.

3. Legacy System Integration: Many enterprises operate hybrid environments, integrating new passkey capabilities with existing IAM/CIAM infrastructure. The points of integration between modern WebAuthn flows and older systems—especially during account setup, migration, or recovery—can introduce seams that attackers exploit. Ensuring seamless, secure integration without creating new attack surfaces is a significant challenge.

4. Lack of Administrator Awareness and Control: Administrators accustomed to managing passwords or traditional MFA methods may not fully grasp the implications of passkey enrollment and recovery. Inadequate policies, insufficient logging, or a lack of granular controls over passkey management can leave organizations exposed.

Protecting the Enterprise: A Multi-Layered Approach

Securing passkeys requires enterprises to focus on several key areas, moving beyond the simple deployment of WebAuthn to a comprehensive strategy that addresses the full attack surface.

1. Robust Enrollment Policies and Processes

• Strong Identity Proofing: For initial passkey enrollment, especially for high-value accounts, mandate strong identity verification. This may involve requiring existing strong MFA, in-person verification, or strict checks against authoritative identity sources. The goal is to ensure that only the legitimate user can register a new passkey.
• Device Attestation and Binding: Implement mechanisms to verify the authenticity and integrity of the device on which a passkey is being registered. Where possible, bind passkeys to specific, trusted enterprise-managed devices. This reduces the risk of an attacker enrolling a passkey on their own device.
• Secure Self-Service Enrollment: If self-service enrollment is offered, ensure the process is rigorously secured against social engineering. This includes clear, unambiguous user prompts, out-of-band verification steps (e.g., via a registered and verified email or phone number), and rate limiting to prevent automated attacks.

2. Enhanced Account Recovery Mechanisms

Account recovery is inherently sensitive and a frequent target for attackers. Enterprises must design recovery flows with extreme caution:

• Multi-Factor Recovery: Require multiple, distinct factors for account recovery that are difficult to compromise simultaneously. This could include a combination of verified personal information, security questions, and out-of-band verification using pre-registered trusted contact information.
• Time Delays and Review: Implement mandatory time delays for account recovery processes, especially those that grant access to new devices or credentials. This provides a window for security teams to detect and respond to suspicious activity. Manual review of high-risk recovery requests can also be invaluable.
• User Notification: Always notify users immediately and conspicuously (e.g., via email to a trusted address, push notification to existing trusted devices) whenever an account recovery attempt is made or a new passkey is registered. Empower users to easily report fraudulent activity.

3. Continuous Monitoring and Anomaly Detection

Visibility into identity-related events is paramount. Security teams need to:

• Log Everything: Implement comprehensive logging for all passkey-related activities, including enrollment attempts, successful enrollments, recovery requests, and authentication events. These logs are crucial for forensic analysis and threat hunting.
• Behavioral Analytics: Leverage User and Entity Behavior Analytics (UEBA) to detect anomalies in passkey usage, enrollment patterns, or recovery attempts. For example, a passkey enrollment from a new, untrusted geographical location or on a previously unseen device should trigger an alert.
• Real-time Alerts: Configure alerts for critical events, such as multiple failed passkey enrollments, rapid changes in authentication methods, or recovery requests for high-privilege accounts.

4. User Education and Awareness

While passkeys are phishing-resistant, users can still be socially engineered. Ongoing education is vital:

• Beyond Passwords: Educate users on how passkeys work and, crucially, how they differ from passwords. Explain that they should never approve a passkey prompt unless they initiated the action on a trusted device.
• Social Engineering Tactics: Train users to recognize and report social engineering attempts, including vishing calls or suspicious messages that might trick them into initiating passkey enrollment or recovery.
• Secure Device Practices: Emphasize the importance of securing the devices where passkeys are stored, as physical compromise of these devices can lead to account takeover.

The Path Forward: Integrated CIAM and PKI Management

The move to passkeys fundamentally underscores the need for mature CIAM and integrated PKI management. Enterprises must adopt platforms that offer:

• Centralized Passkey Management: A unified view and control plane for all passkeys across the organization, allowing for robust policy enforcement, auditing, and revocation.
• Adaptive Authentication: The ability to dynamically adjust authentication requirements based on context (e.g., device posture, location, user behavior) to provide additional friction for high-risk enrollment or recovery events.
• Developer Guidance: Clear and secure SDKs and APIs for developers implementing passkey support, minimizing the risk of introducing implementation flaws.

The promise of passkeys—a truly phishing-resistant and user-friendly authentication experience—remains strong. However, realizing this promise in an enterprise context demands a sophisticated security strategy that extends far beyond the cryptographic core. By rigorously securing enrollment and recovery flows, implementing robust monitoring, and educating users, enterprises can harness the full power of passkeys while mitigating the evolving attack surface. Ignoring these critical CIAM stages is an open invitation for sophisticated adversaries to bypass even the strongest authentication.