CYBERUK 2026 Tech Talk - Passkeys at Sophos: Making CISOs, CIOs & employees happy (all at once)

Why passkeys

Sophos CISO Ross frames passkeys as an escape from the password/MFA arms race that increases user friction. Passkeys remove phishable shared secrets, improve login experience, and can reduce helpdesk load—benefits for employees, CIOs, and security leaders across roughly 6,000 staff.

Deployment context

Success depended on broader perimeterless access modernization, not an isolated security project. Sophos also enabled passkeys for hundreds of thousands of customers, though adoption remained low but growing.

Attempt one: grassroots YubiKeys

Security champions received YubiKeys informally, including cross-border shipping complications with Indian cryptographic import rules. Enthusiasts rarely enrolled them for corporate use despite understanding the technology.

Attempt two: IT-led mandate

IT treated rollout as logistics, mandating passkeys for security-critical roles and shipping two physical keys per person. Problems emerged quickly: engineers conflated passkeys with TOTP, enrollment took days, and users disliked carrying a second backup key—especially without physical car keys in a phone-only world.