Passwords are simultaneously your most attacked control and your biggest helpdesk expense. WebAuthn — the standard behind Windows Hello, Touch ID and FIDO2 security keys — replaces them with device-bound cryptographic credentials that phishing kits simply cannot harvest.
The hesitation is never about the cryptography; it's about the rollout. What if users get locked out? What about shared ward or plant-floor computers? What about the chairman's tablet? All answerable with staging.
The staged path
Stage one: enable WebAuthn as an additional MFA factor. Users enrol biometrics alongside existing methods; nothing breaks, enrolment data accumulates.
Stage two: make passwordless the default login for a pilot group — IT first, then a business department. Passwords remain a fallback governed by policy. Watch two metrics: fallback usage rate and helpdesk tickets. Both should trend down within weeks.
Stage three: expand by population, tightening fallback policy as confidence grows. Shared workstations get hardware security keys or push-approval flows instead of platform biometrics. Privileged users go passwordless-plus — WebAuthn combined with context policies that also evaluate network and time.
What changes on day 90
Organisations that complete stage three consistently report the same pattern: password-reset tickets collapse, login time drops from tens of seconds to under three, and — the part security teams care about — credential-phishing attempts stop yielding anything at all.
The prerequisite is an access platform that treats authentication methods as policy, not plumbing: per-application assurance levels, controlled fallbacks and full audit of which factor authenticated which session.