Phishing-Resistant MFA for Small Businesses: Passkeys, Security Keys, and a Practical Upgrade Plan
Learn how passkeys, FIDO security keys, WebAuthn, and phishing-resistant MFA can strengthen small-business accounts—and how to plan an upgrade without disrupting users.
Multi-factor authentication is one of the most practical security improvements a small business can make, but not every MFA method resists phishing equally well.
An attacker who steals a password may also try to trick an employee into typing a one-time code into a fake login page or approving a fraudulent push notification. That is why current CISA guidance tells small and medium-sized businesses to aim for phishing-resistant MFA and to use the strongest authentication option available.
For many organizations, that means learning how passkeys, FIDO security keys, and WebAuthn-based authentication fit into the account-security plan.
SMART Solutions provides Cybersecurity Protection focused on devices, access, network exposure, and practical risk reduction, and a Network & Security Assessment can help identify access and technology gaps before changes are prioritized.
SMART takeaway
The goal is not simply “turn on MFA.” It is to make stolen credentials harder to reuse.
Start with the accounts that can cause the most damage if compromised, choose phishing-resistant authentication where the platform supports it, and build recovery and enrollment procedures before forcing a company-wide change.
What does phishing-resistant MFA mean?
Phishing resistance is about preventing an attacker from successfully reusing authentication information on an impostor site.
NIST SP 800-63B explains that passwords are not phishing-resistant and that authenticator methods involving manual entry of an output, such as many one-time-password flows, are not considered phishing-resistant because an attacker may be able to relay that output to the legitimate service.
By contrast, NIST identifies WebAuthn as an example of phishing-resistant authentication because the authentication process is cryptographically bound to the legitimate verifier or domain.
Source: NIST SP 800-63B — Authenticators
CISA gives businesses similar practical guidance: require MFA wherever possible, prioritize administrative and sensitive access, and use the strongest MFA method available.
Source: CISA — Require Multifactor Authentication
Where passkeys fit
A passkey is a credential based on public-key cryptography rather than a reusable shared password.
With WebAuthn/FIDO authentication, the service stores a public key while the corresponding private key remains controlled by the authenticator. The authentication ceremony is tied to the legitimate service, which makes the credential materially different from a password or code that a user can simply type into the wrong website.
The FIDO Alliance explains that passkeys are unique to the online service and bound to its domain. Passkeys may be stored in platform authenticators built into devices or in hardware security keys, depending on the implementation.
Source: FIDO Alliance — Passkeys
Passkeys, security keys, and “passwordless” are related—but not identical
The terminology can get confusing quickly.
Passkeys
Passkeys are FIDO credentials that can be used to sign in with public-key cryptography. Depending on the provider and configuration, a passkey may be synced across a user’s approved devices or may remain bound to a specific authenticator.
NIST’s current guidance discusses syncable authenticators as an option that can provide phishing resistance when properly configured, while also emphasizing that organizations should evaluate security, privacy, and user-experience tradeoffs.
Source: NIST SP 800-63B — Syncable Authenticators
Hardware security keys
A hardware security key is a physical authenticator that can store FIDO credentials. It can be useful when a business wants a device-bound authentication option, especially for privileged administrators or other higher-risk accounts.
CISA’s phishing-resistant MFA guidance describes FIDO/WebAuthn authenticators as either platform authenticators embedded in laptops or mobile devices or separate roaming authenticators connected through methods such as USB or NFC.
Source: CISA — Implementing Phishing-Resistant MFA
Passwordless authentication
“Passwordless” describes an experience where a password is no longer required for that sign-in flow.
A business should not assume every product marketed as passwordless automatically provides the same security properties. The important questions are which authentication protocol is used, how recovery works, how devices are enrolled, and whether the resulting authentication is phishing-resistant.
Why this matters for small businesses
Small businesses increasingly rely on cloud accounts for email, file storage, billing, customer information, remote access, websites, finance, and administration.
When one identity can reach several business systems, account security becomes part of operational security—not merely an IT preference.
CISA specifically recommends that businesses require MFA on systems such as email, file storage, and remote access, starting with administrators and employees who handle sensitive data.
Source: CISA — Require Multifactor Authentication
That makes authentication a natural part of a broader cybersecurity review. SMART Solutions’ Cybersecurity Protection service is positioned around devices, access, networks, and practical security recommendations rather than treating any one control as a complete security program.
Which accounts should you upgrade first?
A small business does not have to migrate every account on the same afternoon.
Start with the accounts where compromise would create the highest impact.
- Global or tenant administrators
- Email administrators
- Remote-access and VPN administrators
- Cloud storage administrators
- Accounting and financial accounts
- Password-manager administrators
- DNS, domain registrar, and website hosting accounts
- Backup administrators
- Security-system and network administrators
- Users with access to sensitive customer, employee, medical, or financial information
CISA’s guidance repeatedly prioritizes privileged and sensitive access for stronger MFA. The principle is straightforward: protect the accounts that can change security settings, create new users, reset credentials, or reach the most valuable data first.
A practical 8-step phishing-resistant MFA rollout
A good rollout is not just a technical toggle. It is an identity, device, recovery, and support project.
- Inventory important systems. List email, cloud storage, remote access, finance, backup, line-of-business applications, admin portals, and other systems that hold important business access.
- Identify privileged accounts. Separate administrator accounts from everyday user accounts and determine which identities can change security settings or reset other users.
- Check authentication support. Document which services support WebAuthn, passkeys, FIDO security keys, authenticator apps, number matching, or only weaker fallback methods.
- Choose the target method by risk. Consider phishing-resistant authentication first for administrators and higher-risk users instead of treating every account identically.
- Plan enrollment. Decide who enrolls devices, whether users need one or more authenticators, and what happens when a device is replaced.
- Design account recovery. Define how identity will be verified when a user loses a phone, laptop, or security key. Recovery should not quietly become the easiest way around the stronger login method.
- Pilot before enforcement. Test with a small group across the real browsers, operating systems, mobile devices, remote workflows, and applications employees use.
- Enforce, document, and review. Roll out in controlled groups, remove obsolete authentication methods when appropriate, document exceptions, and periodically verify that privileged accounts still use the intended controls.
Do not ignore account recovery
The strongest login method can be undermined by a weak recovery process.
Before enforcing a new authentication method, answer practical questions:
- What happens if an employee loses the enrolled phone?
- What happens if a laptop is replaced unexpectedly?
- Does the user have a second approved authenticator?
- Who can reset or re-enroll an administrator?
- How is the user's identity verified before recovery?
- Are emergency administrator accounts documented and tightly controlled?
- Are former employees' authenticators removed promptly?
Recovery should be intentionally designed, tested, and restricted—not improvised during an incident.
What if a system does not support phishing-resistant MFA?
Many businesses use a mix of modern cloud services and older line-of-business applications. Not every platform will support the same authentication choices.
CISA acknowledges this reality. Its MFA guidance says phishing-resistant MFA is the target, but organizations that cannot implement it everywhere should still use stronger available MFA rather than leaving accounts protected only by passwords.
For systems that do not yet support WebAuthn/FIDO, evaluate the strongest supported option and document the exception.
That may include:
- Authenticator-app MFA
- Number matching for push-based authentication
- Hardware tokens supported by the application
- Conditional-access controls where the identity platform supports them
- Restricting administrative access to approved devices or networks
- Reducing privileges on the affected account
- Replacing or upgrading legacy systems when authentication limitations create unacceptable risk
CISA’s “More than a Password” guidance specifically identifies FIDO/WebAuthn as the widely available phishing-resistant option and recommends stronger alternatives such as number matching when phishing-resistant MFA cannot yet be implemented.
Source: CISA — More than a Password
MFA is not a replacement for the rest of cybersecurity
Phishing-resistant authentication can significantly improve account protection, but it does not secure an entire business by itself.
A business still needs to consider:
- Endpoint and device protection
- Software updates and vulnerability management
- Network security and segmentation
- Secure remote access
- Backups and recovery
- Least-privilege access
- Administrator-account separation
- Email and phishing defenses
- Employee security awareness
- Incident-response procedures
Our business VPN and remote-access security checklist explains why remote connectivity should be reviewed together with identity, device health, access scope, and network controls.
For a broader provider-selection perspective, see Cybersecurity Services in Miami: 10 Questions Small Businesses Should Ask.
Questions to ask your IT provider before changing authentication
- Which business systems support passkeys or FIDO/WebAuthn today?
- Which accounts are privileged or high impact?
- Which existing MFA methods are still enabled?
- Do administrators use separate everyday and privileged accounts?
- How will lost-device and lost-key recovery work?
- Should high-risk users receive hardware security keys?
- Can legacy authentication methods be disabled after migration?
- How will employee onboarding and offboarding handle authenticators?
- What exceptions exist, and who owns the risk?
- How will the configuration be reviewed after rollout?
A Network & Security Assessment can help identify access, device, connectivity, and technology gaps before a business chooses its next security priorities.
Practical security
Upgrade authentication by risk, not by buzzword.
Inventory the accounts that matter, use phishing-resistant methods where supported, build a safe recovery process, test real user workflows, and document the systems that still require weaker authentication.
When should a small business consider passkeys or security keys?
Consider a phishing-resistant MFA project when:
- Administrators still rely on passwords plus SMS or manually entered codes
- Employees regularly access business systems remotely
- The company has experienced repeated phishing attempts
- Sensitive cloud accounts are accessible from unmanaged or widely distributed devices
- A cyber-insurance, customer, vendor, or internal security review is pushing the organization toward stronger identity controls
- The company is already planning a Microsoft 365, Google Workspace, identity-provider, VPN, or device-management cleanup
- There is no documented process for protecting privileged accounts
The exact implementation depends on the platforms already in use. The right project is usually an authentication inventory and risk-prioritization exercise first, followed by controlled enrollment and enforcement.
If your business wants to review identity, devices, network exposure, and practical security improvements together, contact SMART Solutions to discuss a cybersecurity assessment and prioritized improvement plan.