Your business cannot afford to wait for the next account takeover. Passwords are still being stolen, reused, guessed, and handed to attackers through increasingly convincing phishing campaigns. Even push-based MFA is no longer enough on its own.
Attackers now use adversary-in-the-middle, or AiTM, phishing kits to sit between you and the real login page. They can capture passwords, relay MFA prompts, and steal the session token that proves you already signed in.
That means the right question for your Cedar Rapids or Iowa City business is no longer, “Do we use MFA?”
It is:
Are your most important accounts protected by MFA that a fake website cannot trick, relay, or replay?
In 2026, the answer increasingly points to passkeys and FIDO2 security keys.
1. Why passwords and push MFA keep failing
Traditional authentication depends on information you can type or approve. That creates several openings for criminals.
Credential stuffing
When a password is exposed in one breach, attackers try it on Microsoft 365, Google Workspace, banking portals, payroll systems, and other services. If you reuse passwords, one unrelated breach can become a business email compromise incident.
MFA fatigue and push bombing
Push MFA is much better than a password alone. However, an attacker with a stolen password can repeatedly send approval prompts until you accidentally accept one, or approve it simply to make the notifications stop.
This is called MFA fatigue, or push bombing. It targets your attention, not just your technology.
AiTM phishing kits
Modern phishing pages do more than collect your username and password. They proxy the real login process in real time.
You may see a familiar Microsoft or Google sign-in screen. You may even complete MFA. But the attacker is watching the exchange and capturing the resulting session token.
Stolen session cookies
A session cookie acts like a temporary pass that tells a service, “This user has already authenticated.” Malware, malicious browser extensions, infostealers, and compromised devices can sometimes steal that pass.
A stolen cookie can allow an attacker to bypass the normal login process until the session expires or is revoked.
This is why “we have MFA” is not the same as “we have phishing-resistant MFA.”
For a broader look at layered protection, review these cybersecurity services for local businesses.
2. What a passkey actually is
A passkey is a secure digital credential built on FIDO2 and WebAuthn standards.
Here is the plain-English version:
- Your device creates a private key and a public key.
- The private key stays protected on your device.
- The website receives only the public key.
- When you sign in, your device proves it has the private key.
- Your face, fingerprint, PIN, or device unlock confirms that you are the person using it.
You never type a password into the website. You never read a one-time code to an attacker. The private key is also tied to the legitimate website’s domain.
If you visit a fake Microsoft 365 login page, your passkey will not authenticate there. The fake page cannot use the credential because it is not the real domain.
That origin binding is the critical difference.
Where you may already use passkeys
Your team may already have compatible devices:
- Windows Hello on supported Windows computers
- Face ID or Touch ID on iPhones and iPads
- Android screen locks and biometrics
- FIDO2 hardware security keys for high-risk users and administrators
- Built-in passkey support for Microsoft 365 and Microsoft Entra ID
- Passkey support across many Google Workspace accounts and services
A passkey can be device-bound, such as a hardware key, or synced through a trusted platform account. Your provider should help you choose the right approach for your risk, workforce, and device environment.
3. The numbers behind the shift
The 2026 data shows that passkeys are no longer an experimental idea.
According to the FIDO Alliance’s 2026 passkey research:
- An estimated 5 billion passkeys are now in use worldwide.
- 90% of consumers are aware of passkeys.
- 75% have enabled a passkey on at least one account.
- 68% of surveyed organizations with 500 or more employees have deployed, piloted, or are actively deploying passkeys.
- Yet 57% still rely on a phishable method as the primary day-to-day sign-in method.
- Organizations using passkeys report 35% fewer password-reset tickets and 32% fewer phishing-related incidents.
- 89% say they are confident they can restore access if a passkey is lost.
The security case is also strong. Microsoft has reported that phishing-resistant authentication blocks more than 99% of identity-based attacks in its telemetry. The exact result depends on your environment and whether weak recovery methods remain available, but the message is clear:
Passkeys can stop the login-stage attack that passwords, SMS codes, one-time passwords, and push approvals cannot reliably stop.
They do not make every cyberattack impossible. They make one of the attacker’s most profitable paths much harder.
4. How to roll out passkeys in a small business
You do not need to convert every account on one stressful afternoon. A staged rollout is safer.
1. Start with email and cloud administrators
Protect the accounts that can unlock everything else:
- Microsoft 365 or Google Workspace administrators
- Email administrators
- Payroll and financial system administrators
- Backup administrators
- Remote access and VPN administrators
- Owners and executives with broad permissions
Use hardware security keys for especially sensitive administrator accounts. Register at least two keys per person, stored separately.
2. Move to the rest of your team
After testing your process, enroll employees in groups.
Use Windows Hello on company-managed Windows devices. Use iPhone or Android passkeys when appropriate. Give employees a short demonstration so they understand that a passkey is usually faster than typing a password and approving a push notification.
3. Keep legacy applications contained
Some older applications will not support FIDO2 yet. Do not let those applications hold back your entire security program.
Instead:
- Put legacy applications behind a supported identity provider when possible.
- Use single sign-on to reduce the number of separate logins.
- Keep passwords unique and stored in an approved password manager.
- Require stronger controls for access to sensitive data.
- Create a replacement plan for outdated software.
- Restrict legacy access by device, location, or role.
Legacy software should be treated as a known exception, not as the default standard for the whole company.
4. Design recovery before enrollment
The biggest rollout mistake is treating recovery as an afterthought.
Define what happens when someone loses a phone, replaces a laptop, or loses a security key. Your process should include:
- Two registered passkeys or security keys for high-risk users
- A documented identity-verification process
- A restricted help desk reset procedure
- Separate break-glass administrator accounts
- Strong monitoring on recovery and factor changes
- Immediate revocation of lost devices and keys
- A written list of who can approve emergency access
A break-glass account should be protected, monitored, and used only during a real emergency. It should not be a convenient shortcut for everyday work.
5. What to tell your employees
Your message should be simple and practical:
- You will not be asked to approve unexpected MFA prompts.
- A passkey is safer because it cannot be used on a fake website.
- Your fingerprint or face unlocks your device; it is not sent to your employer.
- Never share a security key or let someone enroll a new factor for you.
- Report a lost phone, laptop, or security key immediately.
- Call the known company number if someone asks you to reset access urgently.
Explain the reason for the change. Employees are more likely to support passkeys when they understand that the goal is to make sign-in both safer and easier.
6. Ask these questions when evaluating a provider
Before you choose a technology or implementation partner, ask:
- Can you deploy FIDO2 passkeys for Microsoft 365 and Google Workspace?
- Can you protect administrators first and then roll out to all employees?
- How will you disable or restrict SMS, email codes, and push approvals as fallbacks?
- How do you handle Windows Hello, iPhone, Android, shared devices, and remote workers?
- What is your process for lost devices, lost keys, employee offboarding, and account recovery?
- How are break-glass accounts protected and monitored?
- How will you detect stolen sessions, suspicious sign-ins, and unusual mailbox activity?
- What happens when a legacy application does not support passkeys?
- Will you document the rollout and train our employees?
- Who responds if an account is compromised outside normal business hours?
If the answer is simply, “We will turn on MFA,” keep asking questions. You need a plan that addresses phishing-resistant authentication, device security, recovery, monitoring, and response.
7. What to look for in a complete plan
Passkeys are powerful, but they are one layer of your defense. Look for a provider that combines them with:
- Email security to block malicious messages before they reach employees
- Endpoint protection for laptops, desktops, and mobile devices
- Patch management to close known vulnerabilities
- Session monitoring to identify suspicious access after login
- Least-privilege access so one compromised account cannot reach everything
- Security awareness training for phishing, social engineering, and payment fraud
- Reliable backups that attackers cannot easily alter or delete
- 24/7 monitoring and response
- Incident-response planning before an emergency happens
Passkeys help stop the attacker at the front door. Device protection, monitoring, backup, and response help you limit the damage if an attacker finds another way in.
Your next step in Cedar Rapids or Iowa City
A stolen password can expose email, invoices, customer records, cloud files, and financial systems before you realize anything is wrong. A stolen session cookie can make the breach even harder to spot.
You do not have to solve this alone or replace every application at once.
CMIT Solutions of Cedar Rapids-Iowa City can help you identify high-risk accounts, plan a passkey rollout, protect legacy systems, establish recovery procedures, and connect authentication with a broader security strategy. Our local team provides enterprise-level expertise with personal attention for businesses across Cedar Rapids, Iowa City, and surrounding Eastern Iowa communities.
Start with a review of your most valuable accounts. Then build from there with managed IT services and 24/7 monitoring, practical IT support, and a clear security roadmap.
You can also read our local guide on why small businesses in Iowa need a cybersecurity plan.
Do not wait for a password breach to force the conversation. Contact CMIT Solutions of Cedar Rapids-Iowa City today to discuss passkeys, phishing-resistant MFA, and the next layer of protection for your business. Request a cybersecurity conversation.
