Authenticate 2026: Day 3 Recap

By: FIDO Staff

What does the future hold for FIDO, passkeys, and the Authenticate conference itself? Those questions and many more were discussed on day three of the event.

While day one kicked off with many best practices and day two was highlighted by the controversial claim that authentication is dead, day three tackled a host of issues that will impact organizations into 2027 and likely beyond.

Delegating Authority in a Digital World

Sometimes, a user or an entity needs to act on another person’s behalf. That’s the challenge behind the concept of delegated authorization. It’s a concept that Jen Schreiber, Sr. Engineer II at CrowdStrike, detailed in a morning session.

“Really, at the end of the day, we are humans in a physical world, and like expressing that digitally is so complex and not an easy feat,” she said.

Early standards such as OAuth, OIDC and UMA answered a fairly simple question: can this app access this resource for this user? Today the question is much harder. Systems now have to decide whether a particular piece of software, acting for another actor, with authority that traces back to a person, can take a specific action for a specific purpose. 

That shift has produced more than 60 active IETF drafts. Schreiber built her “insider’s roadmap” from interviews with the people writing these standards.

Current work falls into three areas:

• Relationships: Human cases such as power of attorney and digital estates. The OpenID Foundation’s Death and Digital Estate (DADE) Community Group is defining use cases, and the eKYC IDA working group is drafting authority claims alongside a delegated authorization framework.
• AI agents: New drafts include AAuth (Agent Auth), UMA for agents, the Agent Network Protocol, delegated SD-JWTs and Mission-Bound Authorization.
• Delegation chains: When authority passes through several systems or domains, it has to be traceable back to its source. Drafts here build on Token Exchange (RFC 8693) and include Transaction Tokens, cross-domain chaining and ID-JAG.

EU Cyber Resilience Act: Secure-by-Design Imperatives for Passkeys, Identity Systems & Access Control

The EU Cyber Resilience Act (CRA) doesn’t take full effect until December 11, 2027, but some of its obligations are already in force, and vendors shouldn’t wait to prepare. That was the message from Preeti Ohri Khemani, Senior Director at Infineon, and Roland Atoui, managing director of Red Alert Labs, in a morning session. 

The CRA extends the EU’s CE marking to cover cybersecurity. It also requires manufacturers to keep products secure for their entire lifetime.

Atoui said FIDO is starting a work program to help vendors reuse their FIDO certification work for CRA compliance. The program will map FIDO certification requirements to CRA requirements, find the gaps and produce a reusable evidence pack.

“FIDO certification is evidence. It is not conformity,” Khemani said. “Please be prepared to do your own due diligence and conformity assessment on top of it.”

By the Numbers: The Frontline Authentication Gap: Balancing Fast Access with Strong Security

There is a real human risk when authentication slows down activities for frontline workers. It’s a topic of recent FIDO research conducted with Imprivata, which was discussed in an afternoon session.

The study found that organizations that have gone passwordless are seeing faster access and better productivity for frontline workers, which shows that security and convenience can go together.

“People aren’t necessarily trying to circumvent the actual security, but they’re trying to circumvent the friction from the MFA so that they can just continue to do their jobs uninterrupted,” said Ronnie Manning, CMO of the FIDO Alliance.

Key findings from the study:

• Delays to work: About a third of organizations say authentication problems delay employees’ work. Healthcare was hit hardest, at 40%. 
• Lost time: The average organization loses 32,400 hours of productivity a year to authentication friction. 
• Workarounds: 95% of organizations say frontline workers get around authentication by sharing credentials, bypassing MFA or staying logged in. 
• AI impersonation: 57% of organizations report a confirmed or suspected AI impersonation attempt. 
• Passkey use: 28% of organizations use passkeys, and 46% still use passwords alongside them. 
• Fully passwordless: 15% of organizations have dropped passwords completely. 
• Results: About 99% of passwordless organizations report benefits, including faster access, faster user switching and better productivity.

By the Numbers: The 2026 Passkey Index

Passkeys have moved past the early-adopter stage. At the passkey index session, Diego Zavala, Director of Ecosystem Development at FIDO Alliance, and Rakan Khalid, Sr. Director, Identity Product Management at PayPal, discussed the key results from the 2026 Passkey Index report.

Key numbers:

• 36% of successful sign-ins now use a passkey, up from 26% last year.
• 90% of active accounts can use passkeys on average, and 7 of 13 participants offer them to all their users. 
• 42% of eligible accounts have a passkey set up, which is 38% of all active accounts. 
• 93% sign-in success with passkeys vs. 78% with passwords and traditional MFA. 
• 2.8x faster sign-ins with passkeys, saving about 27 seconds each. 
• Savings on SMS one-time codes ranged from millions to hundreds of millions of dollars a year.

Disabling Passwords on a Consumer Platform with Tens of Millions of Users

Enabling passkeys is only one part of the journey for the popular Mercari online marketplace. The other part is killing the password, wherever it lives.

“Just setting up passkeys is not enough, we need to remove the weakest link, which in this case is the password,” said Tatsuya Karino, Engineer at Mercari. “So we decided to remove the password from our service, including registration,  login, recovery – all of them.”

What Mercari did:

• Registration: Mercari put passkey setup directly into sign-up and dropped the password option. Passkeys are still optional so that sign-ups don’t fall off. About half of new users used to register with a password, and that’s now under 1%.
• Login: The old menu of sign-in choices is gone. Users now enter their email or phone first, and Mercari offers the best sign-in method for that account: passkey, social login, password or email link. It turns passwords off automatically for accounts that have a passkey or when the login looks risky.
• Recovery: Password reset links are gone. Users now prove who they are with a photo ID and a selfie, or with Japan’s My Number Card. Then they either register a passkey or update their email and phone, and the old password is turned off either way.

From Passkeys to Digital IDs, What Amazon’s Customers Taught Us

Amazon is serious about passkeys with over 500 million of its users already using the technology.

“Here’s our idea in one line, the only safe password is no password,” Sanyal Chincholikar, Sr. Product Manager – Identity Services at Amazon said. “Every password out there is a door that we have not locked for our customers.”

Amazon has effectively utilized a series of tactics to help grow its passkey user base. One tactic is “conditional create,” which creates a passkey automatically when a customer signs in with a password. Another is a passkey-first experience that uses autofill and auto-click and doesn’t redirect users to a separate sign-in page. 

“We follow three rules: one, we make it available everywhere; second, we put the passkeys first; and third, we make it smooth, with no detours and no redirects,” Chincholikar said.

Ben Christ, Sr. Technical Product Manager for Identity Services at Amazon, talked about the step before sign-in: proving who you are. He warned that AI is making photo-and-selfie ID checks easy to fool. Deepfake attempts are up more than twentyfold in three years. The answer is digital IDs signed by the government that issues them, like driver’s licenses in Apple and Google wallets. A customer would verify once and then reuse that result.

Amazon handles more than 15 million ID verifications a year, but digital IDs make up less than 10% of them. Amazon will start supporting EU digital ID credentials at the end of November.

FIDO CTO: Trust is Not a Feature, It’s an Outcome

Go to any identity conference and you’ll hear the word “trust” constantly, usually without a definition. FIDO Alliance CTO Nishant Kaushik opened his keynote with a novel definition of what trust means to him.

“Trust is not a feature; it is an outcome. It is not something that you can simply add to a product, or include in an RFP, or promise in a marketing campaign,” he said. “It emerges when technology standards, governance, incentives, accountability, and the way people experience systems all work together. People trust systems when the experience is fair, when the choices are real, when the privacy boundaries are clear.”

For that to work at scale, Kaushik argued that trust has to fade into the background the way roads and power grids do. He argued that a digital society cannot rely on trust being reinvented for every interaction. Trust just needs to be there, something we expect but don’t think about, because it works for us in the background, unnoticed. 

“Trust itself must become infrastructure,” he said.

Kaushik closed by framing it as a choice. The industry can keep treating trust as a marketing promise, or it can treat trust as infrastructure built on shared foundations that support choice, competition, utility, and innovation. He said the scorecard should be about real outcomes, not how much technology gets shipped.

“We should measure success not just by how much technology we deploy, but by whether fraud decreases, access improves, unnecessary disclosure declines, and by all the people who can complete the things that they are trying to do,” Kaushik said. “We measure it by how many barriers we remove, how resilient our systems are to abuse, and how reliably they protect and empower the people who depend on them.”

New Frontiers in Agentic Commerce: Who’s Buying? 

At the closing panel, leaders from EMVCo, PayPal, and Visa agreed that agentic commerce is still small but moving faster than any earlier shift in payments.

For EMVCo, that speed is the reason to move early on standards. Arman Aygen, director of technology at EMVCo noted that his organization came out with an early draft of its agentic payment framework to capture the wave of interest and opportunity.

“The sooner we get it out, the more convergence we’re going to get from the industry,” Aygen said.

The interest is there, but transaction volumes haven’t caught up yet, according to Rakan Khalid, who leads PayPal’s identity platform. PayPal is building now anyway. 

“The reality is that the volume right now is low, but we expect that the volume is going to shift there, and so we’re moving fast,” said Khalid.

Visa is seeing the same thing. 

“We are seeing agentic transactions happen, but it’s small,” said Gavin Shenker, a product lead on Visa’s agentic team. “We don’t expect it to stay small, it’s going to grow, it’s going to grow very quickly.”

Next Year in San Antonio!

After three days of content and learning, that’s a wrap for Authenticate 2026. 

The future is about more passkey adoption, agentic AI and digital credentials.

“Passkeys I think really show what this industry can achieve when we align on a vision. Now we collectively just need to do this again, and we will do it with digital credentials,” Andrew Shikiar, Executive Director of the FIDO Alliance, said.

The future will also have different scenery. After four years in Carlsbad, California, Authenticate 2027 moves to a larger venue in San Antonio and grows from three days to four.

Registration is already open, and anyone who signs up by the end of this week pays under $1,000, whether or not they’re a FIDO member.