Author: Andrew Shikiar
Authenticate 2026 is underway in Carlsbad. Listening to the conversations in the session rooms and the hallways today, it is clear the conversation around authentication and passkeys is changing. A few years ago, people came here to ask whether passkeys could really replace passwords at scale. This year, they’re talking about what comes next.
Passkeys: from big idea to everyday reality
In 2022, passkeys were a big idea. The pieces had only just come together: a name people could recognise, credentials that synced across devices, and support from the major platforms. Had anyone predicted then that billions of people would be using them within four years, few would have believed it.
Today, we estimate that more than 7 billion passkeys are in use worldwide. The world’s largest brands and governments are deploying them (and many have shared insights into their progress in our 2026 Passkey Index), and people now routinely use them. The need for passkeys is clear, and was underscored in a recent report FIDO produced with Imprivata on Frontline Friction. The headline finding was that the average organization surveyed reported losing 32,400 hours of frontline work each year due to authentication issues.
The job now is to drive passkeys to ubiquity, making them the default method of authentication, and retiring the weak fallbacks that often still sit behind them.
The new frontier: digital credentials and agentic commerce
Picture a world where you can prove you’re a real person, and prove only the facts that matter, such as your age, your right to work or your qualifications. You could do it anywhere, in seconds, from a wallet you trust. Starting a job, opening an account or renting a home would take minutes, not weeks. Accessing critical services that you’re entitled to becomes hassle free.
The agentic economy takes off, as AI agents now search, book and buy on your behalf but, crucially, they only do this within limits you set, with every action traceable back to you and revocable whenever you choose.
At the same time, organizations secure the entire account lifecycle – reliably verifying every human and machine identity is genuine, at onboarding and throughout its lifecycle. This would mark one of the most disruptive shifts in enterprise cyber and fraud risk.
That is the opportunity ahead of us. But none of it works without trust. Today, digital identity succeeds only in pockets, such as national schemes and state-by-state mobile driver’s licences, that rarely work across borders. And agents that can’t prove who they act for, or within what limits, will never be trusted with real money.
What’s missing is a common foundation that allows the technology to scale globally. That foundation is verified human identity, which acts as a cryptographic root of trust, built upon open, interoperable standards. It is crucial for accelerating digital credentials and agentic commerce, and to making passkeys the default method of authentication without weaker fallbacks.
FIDO’s experience with passkeys has given us a proven playbook for how to take this ambition and make it a reality. Our work on specifications, certification and enablement, backed by a committed community, took passkeys from a concept to billions of users. We’re now bringing the ecosystem together and applying that same playbook to scale digital credentials and agentic commerce globally
We’re making excellent progress on these new frontiers, thanks to the tremendous work of our FIDO technical working groups co-chaired by representatives from Google, Okta, OpenAI, Chase and Mastercard. Please watch this space for some significant news tomorrow.
People, agents… and machines
Much of this week is about authenticating and authorizing people, and the agents that act for them. But trust doesn’t stop there. Every factory, store and remote site runs on connected devices that for secure operation need to prove who they are and who owns them before they are allowed to receive and share data.
That’s what FIDO Device Onboard (FDO) does for machines. It is an open standard that lets a new device prove its identity when it’s first switched on, find its rightful owner and securely receive its credentials and configuration, with no technician needed on site.
Our recently released FDO 2.0 specification scales zero-touch IoT deployment for large enterprises by introducing Delegated Ownership. This allows remote sites to securely onboard hardware without having to manually configure each device. You can read more about this here.
And last month, the Wireless Broadband Alliance published the results of a proof of concept with FIDO that combined OpenRoaming, Passpoint and FDO. In the trial, a test device joined the network automatically the first time it was powered on and began securely transferring ownership to its operator, with no manual setup.
Tomorrow and beyond
People, agents and machines all rest on the same principle: cryptographic proof instead of shared secrets. This will underpin the sessions and conversations over the next couple of days here in Carlsbad, whether it’s driving passkeys to ubiquity, securing and scaling edge networks, ensuring digital credentials are scalable and interoperable, or establishing thriving agentic economy.
