Why Hardware Keys for Your Business
The Case You Can Put in Front of a Finance Director
Most breaches at small and mid-sized companies start with a credential, not an exploit. Hardware-backed, phishing-resistant authentication removes that entire category rather than reducing it - and it replaces a recurring helpdesk cost with a one-off purchase that has no subscription attached.
What Actually Goes Wrong
Attacks on organisations your size are rarely sophisticated. Three routes account for most of them.
A credential that existed in two places. An employee reuses a password between a consumer site and a work account. The consumer site is breached, the credentials circulate, and automated tools try them against your services. No malware, no exploit - see Why Password Reuse is Dangerous.
A convincing login page. Modern phishing kits clone a sign-in screen pixel for pixel and relay both the password and the one-time code to the real service within its valid window. Your two-factor authentication worked exactly as designed, and the attacker is in - see Passkey vs OTP.
An account that should have been closed. Someone left months ago and their access is still live.
None of these require a skilled attacker. All three target identity rather than infrastructure, which is why buying another firewall does not address them.
Why Training Is Not the Answer
Awareness training helps at the margin and it cannot be the primary control, for a structural reason: it asks people to make a correct judgement, under time pressure, every single time, forever.
The lookalike domain test in Common Password Attacks demonstrates the problem in about ten seconds. Most people, including technical ones, do not spot the difference. That is not a discipline failure - the human eye is simply the wrong instrument for comparing domain names.
Phishing-resistant authentication removes the judgement call entirely. The credential itself verifies the domain before responding, so there is nothing to notice and nothing to get wrong. See Are Passkeys Safer?.
What a Hardware Key Changes
| Attack | Password + SMS | Password + TOTP | Hardware passkey |
|---|---|---|---|
| Leaked credential reused | ✅ Blocked | ✅ Blocked | ✅ Blocked |
| Credential stuffing | ✅ Blocked | ✅ Blocked | ✅ Blocked |
| Real-time phishing | ❌ Defeated | ❌ Defeated | ✅ Blocked |
| SIM swapping | ❌ Defeated | ✅ Blocked | ✅ Blocked |
| Credential stored in a personal cloud vault | ⚠️ Depends | ⚠️ Depends | ✅ Not possible |
The row that matters is real-time phishing. It is the attack that currently works against organisations that have already done everything else right.
The Cost Side
Three numbers worth putting on the same page, using your own figures rather than ours.
Password resets. Count the tickets over a quarter and multiply by the loaded cost of the time spent. For most companies this is a permanent, measurable drain that passwordless authentication removes rather than reduces - the ticket category stops existing.
One incident. Business email compromise, a fraudulent transfer, or ransomware entering through a stolen credential. Compare the plausible cost of one event against the cost of equipping everyone.
Subscriptions you are not paying. Hardware is a one-off purchase with no per-seat licence, no cloud tier, and no renewal. Over three years that comparison usually surprises people.
Equip your team
Phishing-resistant authentication on every privileged account, with no cloud vault in the chain and no per-seat subscription. Cards and rings ship ready to provision, and the same hardware covers passkeys, TOTP and credential storage.
Get a business quote
The Compliance Angle
If you fall under NIS2, authentication is not only a security decision. Article 21(2) lists risk-management measures in-scope entities must adopt, including multi-factor authentication at point (j), and guidance increasingly reads "appropriate" as meaning phishing-resistant on privileged accounts and remote access.
Attestation adds something a policy document cannot: with hardware-bound credentials you can evidence which devices were used, rather than asserting that a rule was followed. See Security and Compliance for Organizations.
What It Does Not Solve
Being clear about this is what makes the rest credible.
- A compromised workstation. Authentication proves who started the session; malware on the machine can act inside it afterwards.
- Account recovery. An account with a strong credential and a weak reset path is protected by the reset path.
- Social engineering that targets a person, not a login. A fraudulent invoice does not need to defeat your authentication.
- Everything that still uses passwords. Coverage is growing, not complete - see Passkey vs Password.
Hardware keys close the largest category. They are not the whole programme.
Where to Start
You do not need to equip everyone on day one, and you should not.
- Administrators and privileged accounts - the highest value to an attacker
- Remote access - anything reachable from outside the office
- Finance and anyone who can move money
- Everyone else, once the first three are working
That order captures most of the risk reduction in the first two steps. See Deploying Seedkeeper PRO in Your Organization for how to run it.
FAQ
Why are hardware security keys better than an authenticator app?
Because a one-time code can be relayed by a fake login page in real time, while a hardware passkey verifies the site's domain before responding. Both block stolen credentials; only one blocks phishing.
Is this worth it for a company of twenty people?
The attacks are automated and do not select by size, so exposure is comparable. What differs is that smaller companies rarely have anyone whose job is to notice, which makes prevention worth more than detection.
How do we justify the cost?
Compare three figures using your own data: the recurring helpdesk cost of password resets, the plausible cost of a single credential-based incident, and the absence of per-seat subscription against alternatives.
Do we need to equip every employee?
Not initially. Administrators, remote access and anyone who can move money capture most of the risk reduction. Extending to the rest of the organisation can follow once the first group is running.
Does security awareness training still matter?
Yes, for the attacks that target people rather than logins - fraudulent invoices, urgent requests, phone-based social engineering. It is a poor primary control against phishing precisely because it depends on a correct judgement every time.