Passkeys, not passwords: a rollout plan for a 50-person company

Passkeys are the rare security improvement that people actually like. Signing in becomes a fingerprint or a face scan instead of a password and a code. And because a passkey is cryptographically bound to the real website, a fake login page cannot collect it.

For a company of around fifty people, the technology is ready. What decides success is the rollout: who goes first, what happens when someone loses a phone, and how you avoid leaving a password-shaped back door open.

Before you start: one identity provider

Passkeys work best when every application signs in through a single identity provider. If you have twenty applications with their own logins, the first project is consolidating them behind single sign-on. Without that step, you end up with passkeys on five systems and passwords on fifteen.

The six-week plan

Week 1: admins and the security team

Enroll the people with the most access first. They will hit the edge cases before anyone else, and they are the accounts attackers want most. Give each of them two hardware security keys: one on the keyring, one in a safe place.

Week 2: finance, leadership and anyone who approves payments

These roles are the main targets of payment fraud and executive impersonation. Run a short in-person session; enrolment takes about five minutes per person when someone is there to help.

Weeks 3 to 4: everyone else

Send clear instructions, hold two drop-in sessions, and track enrolment by team. Expect most people to enroll a passkey on their laptop and their phone.

Weeks 5 to 6: remove the fallback

This is the step most rollouts skip. If users can still sign in with a password and an SMS code, attackers will simply choose that path. Change the authentication policy so high-risk roles must use a phishing-resistant method, then extend that to everyone.

The edge cases nobody mentions

• Shared and service accounts. These should not be human logins at all. Move them to workload identity or a secrets manager rather than trying to give them passkeys.
• Lost devices. Write the recovery process before you need it: identity verification by a manager on video, a temporary access pass valid for one hour, immediate re-enrolment.
• Contractors on personal devices. Synced passkeys on a personal phone are still far better than a password. Decide your policy explicitly.
• Old applications that cannot do modern sign-in. Put them behind an access proxy that enforces your identity provider in front of them.

How you know it worked

Three numbers tell the story: the share of sign-ins using a phishing-resistant method, the number of accounts that can still use a password-only path, and the number of help-desk tickets about sign-in. In a well-run rollout the first goes up, the second drops to zero, and the third falls below where it started.