A password and a second login step are no longer enough to tell you how well your organization is protected from phishing. The method matters. A one-time code can be stolen and relayed to an attacker, while a properly configured passkey, security key, or smart card can bind authentication to the legitimate service.
For businesses evaluating cybersecurity consulting, CMMC readiness, or cyber insurance requirements, the right choice depends on more than security strength. Deployment effort, recovery procedures, account coverage, and evidence all matter.
Below, we compare passkeys, FIDO2 hardware security keys, and certificate-based authentication. The goal is to help you choose a method that is practical for your team and defensible during an assessment or underwriting review.
What "phishing-resistant" means
Phishing-resistant authentication is designed to prevent a user from handing a secret or reusable authentication response to an impostor site. FIDO2 and WebAuthn, for example, bind authentication to the legitimate website's domain. A fake login page cannot simply collect and replay the user's response.
That differs from many familiar MFA methods. Text-message codes, email codes, and manually entered authenticator-app codes can be relayed during a convincing phishing attack. App notifications can also be abused through social engineering or repeated approval requests.
The NIST Digital Identity Guidelines explain authentication requirements and discuss phishing-resistant options. The important operational point: MFA is only as strong as its implementation, coverage, and recovery process.
Passkeys: convenient, with an important distinction
A passkey uses public-key cryptography instead of a password that can be copied and reused. Users typically authenticate with a device PIN, fingerprint, or face recognition. Because the credential is tied to the real website or service, a lookalike phishing page cannot authenticate as the legitimate site.
There are two broad deployment models:
- Synced passkeys can be available across a user's devices through an account ecosystem. They are convenient for a workforce using multiple devices, but rely on the provider's account security and recovery processes.
- Device-bound passkeys stay on one device and are not synchronized. They offer tighter control, but users may need another registered authenticator to avoid losing access if a device is lost or replaced.
Phishing resistance: Strong when supported and correctly configured. The domain binding is the key advantage over codes that can be intercepted and relayed.
Deployment friction: Usually low to moderate. Passkeys can be easier to roll out than physical keys, especially where employees already use compatible devices and identity systems. Support for apps and platforms should be tested before broad deployment.
Cost: Often low in direct hardware costs, particularly when existing devices can act as authenticators. Account recovery, identity-provider configuration, and user support still require planning.
CMMC and insurance fit: Passkeys can support a strong authentication program, but the label alone does not prove that an implementation satisfies MFA requirements. Confirm how the identity provider treats user verification, which account types and access paths are covered, and how recovery is handled. Underwriters may also ask whether MFA is enforced for key services and high-risk users, rather than simply whether passkeys are available.
Passkeys are a strong option for general users when the organization is comfortable with the synchronization model and has secured the underlying account and recovery process.
FIDO2 hardware security keys: strong control for high-risk access
A FIDO2 security key is a physical authenticator that connects to a device through USB, NFC, or another supported method. Like passkeys, FIDO2/WebAuthn authentication is bound to the legitimate service, making it highly resistant to credential phishing.
A key can be configured to require a PIN or another user-verification step. Organizations should confirm the specific configuration and authentication flow rather than assume every key provides the same factors.
Phishing resistance: Very strong when properly configured. Authentication is tied to the service's real domain, so a phishing site cannot collect a reusable code.
Deployment friction: Moderate. IT teams need to issue and register keys, support compatible devices, and provide a process for lost or damaged keys. High-risk users should have a backup key registered in advance. Recovery should not quietly fall back to a weaker method.
Cost: Moderate. There is a hardware cost per user, with additional keys recommended for continuity. That cost may be justified for accounts where compromise could have a major business impact.
CMMC and insurance fit: Hardware keys can be a strong choice for privileged access and other sensitive workflows. To demonstrate MFA, document the key's configuration, user-verification requirements, account coverage, and recovery controls. Underwriters may view broad enforcement on administrator, email, and remote-access accounts more favorably than optional enrollment, although insurer requirements vary.
Consider hardware keys for administrators, executives, finance and payment approvers, and employees with production or sensitive-data access. The FIDO Alliance's guidance on FIDO authentication provides additional background on these approaches.
Certificate-based authentication: a fit for managed environments
Certificate-based authentication uses a digital certificate to associate a user or device with a trusted identity. Common examples include smart cards and PIV/CAC-style credentials. The private key may be protected by a card or another hardware device, while a certificate authority manages issuance and revocation.
Phishing resistance: Strong when the private key is protected and the authentication method is implemented appropriately. Certificate-based authentication is most compelling when it uses hardware-protected keys and is integrated consistently across the services in scope.
Deployment friction: High compared with passkeys or security keys. Organizations need certificate lifecycle management, compatible endpoints and applications, user support, and procedures for issuing, renewing, revoking, and replacing credentials.
Cost: Typically higher in operational effort. Costs can include PKI infrastructure or services, smart cards and readers, integration work, and ongoing administration.
CMMC and insurance fit: Certificate-based authentication can be a strong fit for organizations with established PKI or contractual requirements for smart-card use. An assessor still needs evidence that it covers the required account types and access paths. Underwriters may value a well-managed certificate program, but the method alone does not guarantee favorable terms.
For an organization without PKI in place, the added complexity may not be worthwhile. For a managed environment where certificates are already part of daily operations, it can be a sound choice.
Comparison at a glance
| Method | Phishing resistance | Deployment friction | Cost profile | Common fit |
|---|---|---|---|---|
| Passkeys | Strong when correctly configured | Low to moderate | Often lower hardware cost | Broad workforce use |
| FIDO2 hardware keys | Very strong | Moderate | Hardware plus support | Privileged and high-risk accounts |
| Certificate-based authentication | Strong with protected keys and sound implementation | High | Higher operational overhead | Managed environments with existing PKI |
What a CMMC 3.5.3 assessor and an insurer will look for
CMMC requirement 3.5.3 calls for MFA for local and network access to privileged accounts and network access to non-privileged accounts under the applicable NIST SP 800-171 Rev. 2 requirements. The NIST SP 800-171 Rev. 2 publication is a useful reference for the underlying control.
The assessor's focus is not simply which authenticator you bought. Be prepared to show:
- Which privileged and non-privileged accounts and access paths are in scope.
- How MFA is required for those accounts, including relevant local and network access.
- How the configured method provides the required factors.
- How exceptions, emergency access, and account recovery are controlled.
- Evidence such as identity-provider policies, enrollment records, and authentication logs.
For CMMC preparation, verify the requirements that apply to your contract, assessment scope, and current program rules. A security risk assessment can help identify gaps between the written policy and the way accounts are actually configured.
Cyber insurance underwriting is not uniform. Carriers may ask whether MFA is enabled for remote access, email, administrator accounts, and financial workflows, and may ask about the method and exceptions. Stronger MFA can improve your risk posture, but it does not guarantee coverage, a premium reduction, or a particular underwriting outcome. Review the insurer's application and policy terms, and keep evidence of your controls.
A practical way to choose
For many organizations, a risk-based rollout is the most practical starting point:
- Enforce phishing-resistant MFA for administrators and other high-impact accounts.
- Choose device-bound passkeys or FIDO2 hardware keys for users with elevated access.
- Use synced passkeys more broadly where the identity provider, device ecosystem, and recovery model are acceptable.
- Use certificate-based authentication when existing PKI or business requirements justify its added operational effort.
- Document coverage, exceptions, and recovery procedures, then test the configuration.
The Splashwire cybersecurity operations team can help organizations review MFA coverage alongside broader security controls. The best method is the one your organization can enforce consistently, support reliably, and demonstrate with clear evidence.
Frequently asked questions
Do passkeys satisfy CMMC 3.5.3?
They may support a compliant MFA implementation, but do not assume that enabling passkeys automatically satisfies the control. Confirm that the identity provider's configuration provides the required factors and covers the applicable accounts and access paths. Document the design and verify it against the requirements in scope.
Are FIDO2 security keys better than passkeys?
Not categorically. Both can use phishing-resistant FIDO2/WebAuthn authentication. A hardware security key offers a distinct, physical authenticator and can be a good fit for privileged accounts. Passkeys can be more convenient to deploy broadly. The best choice depends on user risk, platform support, and recovery controls.
Does certificate-based authentication require a smart card?
No. Certificates can be used in different configurations. A smart card is one common approach, and protecting the private key in hardware is important for stronger security. The complete setup, including endpoints, services, and certificate lifecycle management, determines how practical and secure it is.
Do insurers require phishing-resistant MFA?
Requirements vary by insurer, policy, and underwriting process. Some may ask about MFA for specific systems or users, while others may distinguish between methods. Review the application and policy language directly, and keep records showing where MFA is enforced and how exceptions are handled.
Get help evaluating your MFA options
Splashwire helps organizations assess security controls, prepare for compliance reviews, and plan practical improvements. If you are comparing authentication methods or preparing for a CMMC assessment, email Splashwire to discuss your environment.