The Credential Sunset: A 2026 Enterprise Playbook for Passwordless Migration

By early 2026, the headline numbers looked like a victory lap: FIDO's 2026 survey found 68% of organisations deploying passkeys and 28% fully passwordless, passkeys carry 36% of successful sign-ins, and 38% of accounts have one enrolled — real progress, still a minority. But ask any CISO how the migration is actually going, and the celebration tends to stop. The easy 80%—the SSO portal, the email client, the collaboration suite—is done. What remains is the unglamorous 20%: the legacy ERP, the vendor extranet, and the service account nobody remembers creating. This is the Credential Sunset problem, and it is where most 2026 passwordless projects quietly stall.

What the Adoption Numbers Actually Say

The most useful figures in the 2026 Passkey Index are not the adoption percentages but the operational ones. Passkey sign-ins succeed about 93% of the time, against roughly 78% for passwords, and complete around 2.8 times faster. Those are the numbers that justify the programme internally, because they describe a login that is both harder to phish and less irritating than what it replaces. The same research finds two thirds of relying parties intending to move to passwordless accounts within twelve months, which is a useful benchmark: if your roadmap runs longer than that, it is not a plan, it is a postponement.

The catch is that enrolment is not the same as use. An account can hold a passkey and still accept a password, and every fallback path is a door an attacker will try before bothering with the front one. Measuring enrolment therefore flatters a migration that has retired nothing. The honest metric is the share of authentications that could not have been completed with a password at all, and for most organisations in 2026 that number sits well below the enrolment figure.

The 80/20 Trap: When 'Mostly Passwordless' Isn't Good Enough

The first wave of passkey adoption targets systems built on modern identity standards—anything that speaks OIDC or SAML can usually be retrofitted with WebAuthn relatively quickly. The problem is the long tail: on-prem ERPs from the 2000s, OT/SCADA interfaces, and the dozens of vendor portals that still expect a username and a static password. Leave these untouched, and you haven't eliminated your password attack surface—you've simply relocated it to the systems with the weakest logging and the oldest patch cycles. A 2026-grade migration treats this 'shadow password estate' as a first-class risk, not an afterthought for 'someday.'

The Recovery Paradox: Securing the Keys to the Kingdom

When a passkey lives inside your device's secure enclave, losing that device doesn't just lock you out—it can sever your entire digital identity. That has made account recovery the highest-value target in 2026, and the incident record shows attackers have adjusted. The path of least resistance around phishing-resistant authentication is no longer the login page; it is the helpdesk queue, where a caller with a plausible story and a cloned voice asks for an emergency credential reset. An organisation that deploys passkeys without redesigning recovery has built a strong front door and left the loading bay open.

Enterprises that get this right have abandoned SMS and email fallback entirely, replacing them with cryptographically-verified 'Trusted Contact' delegation and a recovery ceremony that pairs signed video with a separate, out-of-band confirmation step—because in a world of real-time deepfakes, a video call alone proves nothing, and a high-privilege reset should never hinge on a single channel. Add rate limits on resets, a distinct approval path for privileged accounts, and logs that let you reconstruct who reset what, and on whose authority, weeks later.

2026 Passwordless Migration Roadmap:

• Tier Your Identity Estate: Before rolling anything out, classify every application—Tier 1 (passkey-ready today), Tier 2 (bridgeable via an enterprise credential vault or PAM layer), and Tier 3 (legacy systems needing network-level isolation and compensating controls until they can be retired). For Tier 2, the vault injects the legacy credential behind the scenes so the employee still experiences a single passkey login—an invisible bridge that matters, because a workforce handed 'just one more password' to remember will quietly write it down and undermine the whole rollout.
• Pilot with Champions, Not Executives: Resist the urge to start with the C-suite. Tech-savvy early adopters who enjoy troubleshooting will build the internal documentation and peer support that make the second and third waves of rollout dramatically smoother.
• Harden the Recovery Path First: Redesign helpdesk identity verification and retire SMS/email fallback before flipping the switch on passwordless login—otherwise you've simply moved your weakest link from the front door to the back office.
• Retire the Fallback, Then Measure: Track the share of authentications that had no password option, not the number of passkeys issued. A registry full of enrolled accounts that still accept a password is a pilot that never ended.
• Build a Living Governance Policy: Passwordless isn't a project with an end date; it's an ongoing programme. Schedule quarterly reviews of exception lists, Tier 3 systems, and recovery logs so 'temporary' workarounds don't quietly become permanent.

The organisations that succeed at this transition won't remember 2026 as the year they 'went passwordless'—they'll remember it as the year they started governing identity as a living system: continuously tiered, audited, and improved, rather than switched on once and forgotten.