A passkey rollout needs a recovery test. Getting the normal sign-in right still leaves the question of what happens when someone loses their device.
The Canadian Centre for Cyber Security's passkey guidance warns that alternative login methods can leave residual risk. Its May 1 alert also describes attackers abusing help-desk and recovery processes to reset authentication or enrol devices. Those are published warnings, not a new breach I'm claiming happened this week.
That matters when a rollout report says “MFA enabled” and stops there. A strong front door can sit beside a recovery process that accepts a convincing phone call as proof of identity. The attacker doesn't need to argue with the cryptography if the support procedure gives them another route.
I'd review one important business account from both ends. Confirm the intended sign-in method, then ask how a lost device is handled. Who verifies the request? Who can enrol a replacement? What is recorded, and who is told that the account's recovery settings changed?
For a privileged account, the recovery path deserves the same attention as the daily login. Keep a controlled way to recover access, and test it without locking out the people who operate the business. Removing every fallback in one afternoon isn't a migration plan.
Passkeys are a useful improvement. They still depend on the implementation and the surrounding account lifecycle. Session theft and a compromised device also need their own controls; changing the login method doesn't settle those risks.
The question for this week's technical review is whether the recovery route preserves the assurance you chose for sign-in. Check the whole route before calling the rollout complete.