Why ASD's new authentication guidance demands a closer look at passkeys

The Australian Signals Directorate's (ASD) launch of ASD Essentials on 15 October 2026 signals a significant evolution of the Essential Eight and it also released its 2025–26 Annual Cyber Threat Report on 26 October.  Both of these events reinforce that protecting today's organisations is even more important and demands more than a checklist of controls. 

The ASD Essentials framework spans enterprise IT, cloud and operational technology (OT), prioritising security outcomes and systems exposed to attack. For organisations weighing where to invest first, one message is particularly significant: phishing-resistant multi-factor authentication (MFA) is no longer reserved for mature security programs. It is a baseline expectation in enterprise IT guidance.

ASD's Cyber Threat Report highlights how cybercriminals increasingly exploit trusted relationships and social engineering to gain access to sensitive systems and information. With ASD warning that AI is making phishing attempts more convincing, relying on users to recognise deception is increasingly untenable.

From MFA adoption to MFA effectiveness

Under the Essential Eight, MFA was one of eight core mitigation strategies, with stronger requirements at higher maturity levels. ASD Essentials takes a more outcome-focused approach. The enterprise IT chapter explicitly calls for phishing-resistant MFA when users authenticate to systems, including from untrusted, external or high-risk locations.

The accompanying assessment guidance is equally revealing: SMS codes, voice calls and push-only authentication are identified as examples of non-phishing-resistant methods. However, implementing MFA does not inherently guarantee phishing resistance. Attackers can bypass legacy MFA by persuading employees to disclose a code, approve a fraudulent prompt or sign in through a convincing imitation of a legitimate service. 

Phishing-resistant authentication changes the mechanics of an attack. Passkeys based on industry standards use public-key cryptography and bind authentication to the genuine service. A credential created for one website cannot simply be entered into an attacker-controlled lookalike. The passkey ensures phishing protection without relying on vigilance by the employee to recognise an attacker-controlled site

Not all passkeys offer the same assurance

Once organisations accept phishing resistance as table stakes, they face a more consequential architectural decision: should passkeys be synchronised across devices or bound to specific hardware?

Synced passkeys represent a substantial improvement in convenience and security over passwords and traditional MFA. They can make sign-in easier by allowing users to access encrypted credentials across supported devices through a cloud-based ecosystem. For many consumers and lower-risk business applications, this balance of convenience and security will be appropriate.

However, the ability to copy or synchronise passkeys means authentication credentials can be copied and recovered through another account or service. The organisation must therefore consider who controls the syncing environment, which devices can receive credentials, whether sharing is permitted and how account recovery is protected. These dependencies deserve scrutiny in enterprise risk assessments.

Device-bound passkeys, such as YubiKeys, operate differently. The private key for the passkey is bound to the authenticator and cannot be copied or shared to other devices. These device-bound passkeys can reside on laptops or mobile devices, as well as on dedicated hardware security keys. A hardware security key, like a YubiKey, that is physically separate from a mobile device (laptop or mobile) offers the highest level of security and is compliant with the US National Institute of Standards and Technology's (NIST) AAL3 digital identity guidelines.

Purpose-built authenticators, such as YubiKeys, provide the highest level of Authenticator Assurance, NIST AAL3, by using a login credential that is physically separate from the device used to access the web-based service.

The difference matters most where the consequences of compromised access are severe. Administrators managing identity platforms, executives approving sensitive transactions and contractors accessing critical infrastructure may require a higher level of assurance than someone signing into a low-risk application.

NIST recognises synced passkeys as phishing-resistant but notes that they do not meet its highest authenticator assurance level because their private keys are exportable. That does not mean ASD Essentials mandates security keys. It means organisations need to make a deliberate, risk-based choice rather than treating every passkey deployment as equivalent.

Identity protection is a priority

ASD Essentials places identity services alongside boundary services in its first implementation priority phase. This recognises the danger of compromised authentication infrastructure and puts identity controls early in security uplift programs.

Selecting a phishing-resistant sign-in method is only part of that work. Organisations must also examine how credentials are issued, what happens when an employee changes devices, how access is withdrawn when a contractor leaves and whether help desks can be manipulated into resetting accounts. A strong authenticator loses much of its value if an attacker can bypass it through a weaker enrolment or recovery process.

For higher-risk users, hardware-bound passkeys can strengthen this lifecycle. Where supported, attestation can help security teams verify the type of authenticator being registered, while backup security keys and controlled recovery procedures can reduce pressure to fall back to SMS or other less secure, phishable methods. Device management, session protection and monitoring remain essential because no authentication method eliminates every route to compromise.

A stronger baseline demands sharper decisions

ASD has made it clear that organisations should retain the value of their existing Essential Eight investments and that current regulatory obligations remain in place during the transition. Organisations should map existing controls to the new outcomes, identify gaps and prioritise according to risk.

ASD Essentials moves phishing-resistant MFA from an advanced aspiration to an enterprise security baseline. The next step is to distinguish basic phishing resistance from the higher assurance needed to protect privileged access, sensitive information and critical operations.

Australian organisations should not stop at asking whether their people have passkeys. They should ask where those passkeys live, who controls them and whether the organisation can trust them throughout their lifecycle. Those decisions will determine whether stronger authentication becomes a compliance exercise or a meaningful improvement in cyber resilience.