Passwords vs. Passkeys vs. PAM: Which Authentication Wins for Your Access Control?

Why can't I just use passwords anymore?

You're probably asking: "Why can't I just use passwords anymore?" You've heard the horror stories—breaches, phishing, push bombing. And you've seen the buzzwords: passkeys, phishing-resistant MFA, zero trust. But what does it actually mean for how you should authenticate your users? Here's the blunt truth: passwords alone are no longer acceptable for any system that handles personal, financial, or operational data. NIST SP 800-63B recommends multi-factor authentication at Authenticator Assurance Level 2 (AAL2) for most such systems, requiring two different factors. That's the baseline. But even MFA isn't a silver bullet—CISA warns that some MFA methods are vulnerable to phishing, "push bombing" (MFA fatigue), SS7 exploits, and SIM swaps. So what should you actually do?

Passkeys vs. Traditional MFA: The Showdown

Let's compare the two main contenders for your authentication strategy: passkeys (FIDO2/WebAuthn) and traditional MFA (like one-time passwords or push notifications). I'll evaluate them on security, user experience, and deployment complexity.

Security: Passkeys are phishing-resistant by design. Each passkey is bound to the specific domain it was created for, so a passkey created for your bank won't work on a look-alike phishing site. They use origin-bound public-key cryptography with required local user interaction, making them almost impossible to phish (Microsoft FIDO2 Passkeys). In fact, CISA calls phishing-resistant MFA the "gold standard" and identifies FIDO/WebAuthn as the only widely available phishing-resistant authentication (CISA Phishing-Resistant MFA). Traditional MFA, on the other hand, can be phished—think of a fake site that forwards your OTP. It's also susceptible to push bombing, where an attacker spams your phone with MFA prompts until you finally approve one out of annoyance.

User Experience: Passkeys are a passwordless sign-in: you confirm your identity with a face scan, fingerprint, or device PIN. That's it. No typing, no remembering. Traditional MFA adds friction—you type your password, then wait for a code or approve a push. CISA notes that SSO reduces password fatigue and reuse, but passkeys go further by eliminating the password entirely.

Deployment Complexity: Passkeys require supporting the FIDO2/WebAuthn standard in your apps and enrolling users' devices. The good news: they're built into major platforms now—Microsoft, Google, Apple all support them. Traditional MFA is easier to deploy initially—you just add a one-time password app—but you still have to manage passwords, which is a security and usability nightmare.

But Wait: What About Privileged Access?

Now, let's talk about the people who hold the "keys to the kingdom": your admins with privileged accounts. NIST PAM guidance says that privileged accounts provide elevated, often unrestricted access, and their compromise plays a role in many major breaches. For these accounts, you need more than just passkeys—you need Privileged Access Management (PAM). PAM includes credential vaulting with password rotation, just-in-time privileged access, session recording, and MFA for privileged sessions. You can certainly use passkeys as the MFA factor for PAM, but the PAM layer adds crucial controls like time-based approvals and access reviews. Microsoft's PIM, for example, provides just-in-time access and requires approval for role activation, with time-bound assignments. So, for your regular users, passkeys are a solid choice; for your admins, you need PAM on top.

The Verdict: What I'd Actually Do

Here's my blunt recommendation: stop rolling out traditional MFA for new systems. Instead, implement passkeys (FIDO2/WebAuthn) as your primary authentication method for everything—yes, even your internal apps. The security benefit is undeniable: CISA says FIDO/WebAuthn is the only widely available phishing-resistant authentication. And the user experience is better—no passwords to forget, no OTPs to type. For your privileged accounts, layer PAM on top, using passkeys as the MFA factor. This gives you phishing-resistant authentication plus the just-in-time and session monitoring controls that PAM provides. Yes, there's deployment work, but the payoff is huge. If you're in a regulated industry or handling sensitive data, you should aim for AAL3, which requires a hardware-based authenticator with verifier impersonation resistance—passkeys qualify. Start with a pilot for a non-critical app, measure the user friction, and then roll it out broadly. Your future self will thank you.

Sources

• NIST SP 800-63B - https://pages.nist.gov/800-63-3/sp800-63b.html
• CISA Phishing-Resistant MFA - https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
• Microsoft FIDO2 Passkeys (Entra ID) - https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2
• NIST PAM - https://www.nccoe.nist.gov/financial-services/privileged-account-management
• Microsoft PIM - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure
• CISA SSO - https://www.cisa.gov/sites/default/files/2024-06/Barriers-to-SSO-Adoption-for-SMB-508c.pdf