Passwords have been the key to business systems for decades, and for just as long they’ve been the weak point criminals aim for. In April 2026 the UK’s National Cyber Security Centre (NCSC) said it plainly: passkeys are the future. If you run or manage a small business, passkeys for business are now one of the simplest and most effective security upgrades you can make.
Key takeaways
- The NCSC now recommends passkeys as the first-choice way to log in, and says they are at least as secure as a strong password with two-step verification.
- Passkeys are highly resistant to phishing, the most common attack reported by UK businesses.
- Microsoft Entra ID, which sits behind Microsoft 365, supports passkeys in every edition with no extra licences.
- Start with admin and finance accounts, keep two-step verification as a fallback and plan ahead for lost devices.
What is a passkey?
A passkey replaces the password with something you already have: your phone, your laptop or a small security key. When you sign in, you approve it with your fingerprint, your face or your device PIN.
Behind the scenes, your device and the service use a pair of cryptographic keys to prove who you are. There’s nothing to type, remember or reuse. Passkeys are built on an open standard called FIDO2, so they work across most modern phones, computers and browsers.
Why passkeys for business matter now
Stolen login details are behind a large share of attacks on small firms. The government’s Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses identified a breach or attack in the previous 12 months. Phishing was by far the most common type, affecting 38% of businesses, yet only 47% had any form of two-factor authentication in place.
The NCSC’s announcement says passkeys are highly resistant to phishing and cannot be intercepted, reused or guessed like passwords can. Its technical assessment goes further. Even one-time codes and push approvals can be relayed by criminals during a live attack, whereas a passkey is tied to the genuine website, so a fake login page simply doesn’t work.
Quicker for your team too
Security that slows people down tends to get worked around. Passkeys usually make signing in faster: a glance or a fingerprint instead of a password plus a code. Fewer forgotten passwords also means fewer lockouts and fewer requests for help.
How to get started with passkeys for business
You don’t need to switch everything overnight. A sensible, staged approach looks like this:
- Start with your most valuable accounts. Admin accounts, finance and payroll users, and anyone who approves payments are the biggest prizes for attackers.
- Turn on passkeys in Microsoft 365. Microsoft Entra ID supports passkeys, including those stored in the Microsoft Authenticator app and on physical security keys.
- Decide which types to allow. Device-bound passkeys stay on a single phone or security key. Synced passkeys, such as those in Apple or Google’s password managers, follow the user across devices, so the account they sync through needs strong protection.
- Plan for lost or replaced devices. Register more than one passkey per person where you can, and agree a secure recovery process before you need it.
- Keep two-step verification as a fallback. Not every service supports passkeys yet. Where they don’t, the NCSC recommends a password manager for strong, unique passwords, plus two-step verification.
- Explain it to your team. A short briefing on what a passkey prompt looks like, and why it’s safer, makes the change much smoother.
Common questions
What if someone steals a phone with a passkey on it?
A passkey can’t be used without unlocking the device with a fingerprint, face or PIN. If a device goes missing, remove its passkey from the account and sign in with a backup method.
Do passkeys help with Cyber Essentials?
Cyber Essentials looks closely at how users sign in to your systems and cloud services. Adopting passkeys for business accounts strengthens those controls. Our guide to Cyber Essentials 2026 explains what’s changed in the scheme.
How LevelUp Networks can help
Moving to passkeys for business is a quick win, but it works best as part of a joined-up approach to identity and access. Our cyber security team can review how your people sign in today, set up passkeys and sensible sign-in policies in Microsoft 365, and help you roll them out without disruption. Through our managed IT services, we can then look after accounts, devices and access day to day.
Not sure where you stand? Download our free SME Cyber Security Checklist, email [email protected] or get in touch online. Existing clients can simply email our service desk.