Phishing remains the single most common entry point for cyberattacks targeting UK businesses.
The government’s Cyber Security Breaches Survey found that 85% of businesses that experienced a breach identified phishing as the attack method
, and despite years of awareness campaigns, that figure has barely changed. The reason is straightforward: passwords are fundamentally vulnerable to phishing, and traditional multi-factor authentication (MFA) can now be defeated by readily available phishing kits.
The solution that is rapidly becoming mainstream in 2026 is passwordless authentication, specifically passkeys.
The FIDO Alliance’s State of Passkeys 2026 report estimates 5 billion passkeys now in active use, with 90% consumer awareness and 75% of people having enabled a passkey on at least one account
. For UK SMEs still relying on passwords and standard MFA, the shift to passkeys is no longer optional—it’s becoming a baseline security requirement.
Why Passwords and Standard MFA Are Failing UK Businesses in 2026
Traditional password-based authentication has always been vulnerable, but the threat landscape in 2026 has made these weaknesses critical.
AI removes spelling errors, improves targeting and creates believable voice calls, making phishing harder to detect
. Attackers are now using generative AI to produce highly convincing phishing emails that bypass email filters and fool even security-aware staff.
Even more concerning for UK SMEs is the rise of MFA bypass phishing kits.
Passkeys are phishing-resistant by design, they are cryptographically bound to the domain, so an adversary-in-the-middle proxy cannot capture them the way it captures a standard MFA code
. Professional services firms running Microsoft 365—accountants, solicitors, consultants, recruiters—are particularly vulnerable because they hold valuable client data and have often deployed MFA as their primary control without additional layers of protection.
The statistics paint a concerning picture of UK SME security posture.
Only 40% of UK businesses use two-factor authentication, 31% use a VPN for remote staff, and 30% monitor user activity
. For businesses that do use MFA, many are discovering that standard SMS codes and authenticator app codes can now be intercepted using commodity phishing tools.
What Are Passkeys and How Do They Stop Phishing?
Passkeys are a form of passwordless authentication that uses public-key cryptography instead of shared secrets. When you create a passkey for a website or application, your device generates a unique cryptographic key pair: a private key that stays securely on your device, and a public key that is sent to the service.
When you log in, the service sends a challenge that your device signs using the private key. Because the private key never leaves your device and the authentication is cryptographically bound to the specific domain, phishing attacks cannot work—even if an attacker tricks you into visiting a fake website, your device will not authenticate because the domain does not match.
The performance benefits are substantial.
Passkeys also outperform passwords on the metrics businesses care about — roughly a 93% login success rate versus 63% for traditional methods
. This means fewer password reset requests, reduced support burden, and improved user experience alongside better security.
Passkey Adoption Is Accelerating Rapidly in 2026
Passkey technology has moved from experimental to mainstream in the past 18 months.
FIDO Alliance reports that 48% of the top 100 websites now offer passkeys, more than double the 2022 figure
. Major platforms have made passkeys the default or strongly recommended option:
- Microsoft’s announced response to the broader MFA weakness problem is to make passkeys the default authentication method for Entra ID from September 2026
- Google made passkeys a default option for personal accounts in October 2023
- Apple integrated passkeys into iCloud Keychain across all devices
- 68% of organizations are deploying, piloting, or rolling out passkeys for employee authentication
For UK SMEs, this shift matters because the platforms you already use—Microsoft 365, Google Workspace, and cloud applications—are rapidly moving to passkey-first authentication. Businesses that delay adoption will find themselves increasingly out of step with security best practices and facing higher breach risk.
What UK SMEs Must Do Now: Practical Steps to Adopt Passkeys
The transition to passwordless authentication does not need to be disruptive, but it does require planning.
The catch: most organizations still run passwords in parallel, and 57% of organizations still rely on phishable authentication for primary sign-in
. Here’s how to approach the rollout:
Step 1: Audit Your Current Authentication Estate
Identify which applications and services your business uses and which support passkeys or other passwordless methods. Microsoft 365, Google Workspace, and most modern cloud platforms already support passkeys. Document which systems still require passwords and whether they support hardware security keys as an interim step.
Step 2: Enable Passkeys for High-Risk Accounts First
Start with administrator accounts, finance staff, and anyone with access to sensitive customer data or financial systems. These accounts are the highest-value targets for attackers and deliver the greatest risk reduction when protected by phishing-resistant authentication.
For Microsoft 365 environments, configure Entra ID (formerly Azure AD) to support passkeys and use Conditional Access policies to require phishing-resistant authentication for privileged accounts.
Step 3: Plan Service Accounts and Shared Mailboxes Early
Service accounts, shared mailboxes, and automated processes often get overlooked during authentication upgrades. These accounts cannot use biometric passkeys, so plan alternative solutions such as hardware security keys or certificate-based authentication before you begin rolling out passkeys to staff.
Step 4: Roll Out Passkeys to the Wider Team with Clear Guidance
Provide clear, step-by-step instructions for enrolling passkeys on Windows, macOS, iOS, and Android devices. Most users will enrol passkeys using Windows Hello, Face ID, Touch ID, or Android biometric authentication. The process is typically faster and simpler than setting up an authenticator app.
Run a pilot with a small group of technically confident staff first, gather feedback, refine your documentation, and then expand the rollout. Expect the process to take 6-12 months for full deployment across a typical SME.
Step 5: Keep Passwords as a Temporary Fallback, Not the Default
Most organisations will run passkeys and passwords in parallel during the transition period. The critical decision is which method becomes the default. Configure your systems to prompt for passkey authentication first, with passwords available only as a secondary option. This ensures staff build the habit of using passkeys while maintaining access if they lose a device or encounter technical issues.
How Passkeys Fit with Other Security Controls for UK SMEs
Passkeys are not a standalone solution—they work best as part of a layered security approach. UK SMEs should combine passkeys with:
- Conditional Access policies: Restrict authentication to managed, compliant devices and block access from risky locations or anonymous VPNs
- Email security and anti-phishing tools: Continue using advanced email filtering to block phishing emails before they reach users, even though passkeys prevent credential theft if a user does click a malicious link
- Security awareness training: Staff still need to recognise business email compromise, invoice fraud, and social engineering attacks that do not rely on credential theft
- Cloud misconfiguration monitoring: Many breaches in 2026 result from cloud misconfiguration rather than credential theft, so passkeys must be combined with proper configuration management
- Regular patching and vulnerability management: Passkeys protect against credential-based attacks but do not address unpatched vulnerabilities in your systems
Many UK SMEs are also struggling with security alert fatigue, where the volume of security notifications leads to missed threats. Passkeys reduce the noise by eliminating password-related alerts such as leaked credentials, password expiry warnings, and account lockouts.
What About the Cost and Complexity?
One of the most common concerns UK SME owners raise about passkeys is cost and complexity. The reality in 2026 is that passkeys are typically less expensive and less complex than traditional password and MFA systems:
- No additional hardware required for most users: Staff can use the biometric authentication already built into their laptops, phones, and tablets
- Reduced support burden: Fewer password reset requests, account lockouts, and MFA issues mean lower IT support costs
- Built into platforms you already use: Microsoft 365, Google Workspace, and Azure Entra ID include passkey support at no additional cost
- Simplified compliance: Phishing-resistant authentication is increasingly required or strongly recommended by cyber insurance providers, Cyber Essentials Plus, and customer security questionnaires
For organisations with high-security requirements or staff who work on shared devices, hardware security keys (such as YubiKeys) provide an additional layer of protection. These typically cost £40-60 per key and provide AAL3-compliant authentication for regulated industries.
The Regulatory and Insurance Drivers Behind Passkeys in 2026
Beyond the technical security benefits, UK SMEs face increasing external pressure to adopt phishing-resistant authentication.
Phishing-resistant MFA UK business is no longer a future-state ambition, it is the baseline expectation set by the National Cyber Security Centre (NCSC), the Cyber Essentials Plus assessor pool, your cyber insurer and increasingly the procurement teams of your largest customers
.
Cyber insurance providers are tightening their requirements, with many now asking specific questions about phishing-resistant authentication during underwriting. Businesses that cannot demonstrate strong credential security may face higher premiums or exclusions for social engineering and business email compromise claims.
Public sector and corporate procurement teams are also raising security requirements. If your business supplies services to government bodies, NHS trusts, or large enterprises, expect customer security questionnaires to ask about passwordless authentication and phishing-resistant controls.
Getting Started: Where Kent SMEs Should Begin
For Kent SMEs served by Meridian Micro, the practical first step is to assess your current authentication environment and identify where passkeys can deliver the greatest risk reduction. This typically means:
- Reviewing which cloud platforms and applications you use daily
- Identifying high-risk accounts that should move to passkeys immediately
- Planning a phased rollout that minimises disruption to daily operations
- Ensuring staff understand why passkeys improve both security and user experience
- Documenting the process so new staff can enrol passkeys as part of onboarding
The transition from passwords to passkeys is one of the most significant shifts in business IT security in decades, and UK SMEs that act now will gain both security and operational advantages over those that delay. Passkeys eliminate the most common attack vector, reduce support costs, improve user experience, and position your business to meet evolving compliance and insurance requirements.
If your Kent SME is ready to move beyond passwords and adopt phishing-resistant authentication, Meridian Micro can assess your current environment, recommend the right approach for your business, and support the rollout from pilot to full deployment. Call us on 01303 883111 to discuss how passkeys and passwordless authentication can protect your business in 2026.