The UK is ditching passwords
The UK now leads both the EU and US in ditching passwords in favour of more secure passkeys. This was a key finding in the National Cyber Security Centre’s (NCSC’s) new annual report which looked at cyber incidents which impacted the UK over the last year.
The NCSC noted that most successful compromises still rely on familiar methods. Threat actors routinely exploited known vulnerabilities in internet‑facing systems, used stolen credentials, and employed social engineering to gain access to networks.
Fundamental security measures therefore remain critical to organisational resilience, including wider adoption of passkeys in place of passwords to reduce the risks associated with stolen credentials.
Passkeys replace passwords with cryptographic credentials stored securely on the user’s own device. Users can then log into apps and websites using your device’s screen lock or biometrics (like Face ID, fingerprint scan, or a PIN) instead of typing a password.
“The year included a number of incidents assessed as having links to state or state‑aligned actors. Although their objectives often differ from those of cyber criminals, many target vulnerabilities in internet‑facing systems.
“While some cases involved exploitation of previously unknown vulnerabilities, many involve vulnerabilities for which patches are available but have not been deployed in a sufficiently timely fashion,” the NCSC said.
It noted that the majority of cyber attacks against individuals begin with the theft, compromise or abuse of passwords.
“Even when combined with two‑step verification, passwords and other authentication methods remain vulnerable to phishing and other common attack techniques.
“Over the last year, the NCSC has promoted the adoption of passkeys as a safer, simpler and more resilient alternative to passwords. Passkeys replace passwords with cryptographic credentials that are stored securely on users’ devices.”
Because passkeys use public key cryptography and are tied to the legitimate service being accessed, they are significantly more resistant to the weaknesses that have plagued passwords for decades, including password reuse, weak passwords and phishing attacks.
In 2025, the NCSC officially recommended passkeys as the preferred authentication method for individuals. Since then, the group said it has been working to accelerate passkey adoption at scale with technology providers and online services.7
Government logins
One of the most significant developments this year has been the introduction of passkeys to One Login, the identity service delivered by Government Digital Service (GDS) that enables citizens to access multiple services through a single account.
The NCSC provided technical and security expertise to early adopters such as NHS England, the first government-sponsored app to offer passkeys as a login option for its service.
“This represents a significant milestone in moving passkeys from a security concept to a technology that millions of citizens can use to access services more securely.
“Although the NCSC is already working with other departments across government to support wider adoption, passkeys will only deliver their full security benefit if adoption extends beyond government, and becomes commonplace across the services people use every day,” the group said.
Over the coming year, the NCSC said it will continue working with technology vendors and service providers to encourage implementation and promote good practice.
This will be supported by public communications activity designed to help citizens understand why passkeys are both safer and easier to use than traditional passwords.
