NCSC on Passkeys vs Passwords: What UK SMEs Must Do to Cut Phishing & Account Takeover 

Passkeys are quickly becoming the UK’s “new normal” for sign-in, and the NCSC has been increasingly clear about its preference for them over passwords. For SMEs, this isn’t a tech fad—it’s a direct response to the attacks that hit small businesses hardest: phishing, credential stuffing, and account takeover. The opportunity is simple: reduce breach risk while making login easier for staff—if you roll it out in a controlled way. 

Why this matters now. 

Passkeys are phishing-resistant sign-ins that replace passwords with device-based cryptography (often using Face ID, fingerprint, or a device PIN). That matters because most SME breaches still begin with stolen or reused credentials. 

Key benefits and risks for SMEs: 

* Cuts phishing impact because there’s no password to steal and reuse. 

* Reduces credential stuffing (attackers testing leaked passwords at scale). 

* Lowers helpdesk load from password resets and lockouts. 

* Improves user experience (faster sign-in, fewer prompts). 

* Introduces new operational considerations (device loss, onboarding, recovery). 

Authoritative insight (what the NCSC is getting at) 

The NCSC’s public guidance in recent years has consistently pushed organisations towards phishing-resistant MFA and modern authentication approaches that reduce dependence on shared secrets (passwords). Passkeys align with that strategy because they are built on FIDO2/WebAuthn, which uses public-key cryptography rather than a password database. 

In plain English: 

* A password is a secret you know and can accidentally reveal. 

* A passkey is a cryptographic credential tied to a legitimate website/app, so it’s far harder to trick people into handing it over to a fake login page. 

This also matches what major platform providers and identity ecosystems are doing: rolling out passkeys as a default option to reduce phishing and account compromise. 

Who, what, when, where, why (SME version): 

* Who: SMEs, managed service providers (MSPs), IT leads, directors. 

* What: Replace or reduce passwords using passkeys (plus sensible controls). 

* When: Now—phishing and credential theft are daily, automated threats. 

* Where: Email, Microsoft 365/Google Workspace, finance apps, CRM, admin portals. 

* Why: Stolen credentials remain the cheapest route into small businesses. 

SME-specific impact (why smaller firms feel this first) 

SMEs often have constraints that make password-heavy security especially risky: 

* Lean IT teams mean less capacity to monitor for suspicious sign-ins. 

* High SaaS reliance expands the attack surface across many logins. 

* Shared accounts and weak offboarding (common in small teams) create lingering access. 

* Limited MFA maturity (e.g., SMS-only) leaves gaps against modern phishing. 

* Tighter cashflow makes breach recovery (downtime, incident response, reputational harm) disproportionately painful. 

Passkeys can help precisely because they reduce the “human factor” exposure that attackers exploit.