Why passwordless is not the same as frictionless

The password was never the whole cost

Passkeys remove typing, resets and phishing. They do not remove the harder question: how confident are you in this session right now, and what should happen when confidence drops mid-journey?

Teams that stop at passkeys often reintroduce friction elsewhere: blanket one-time codes on every sensitive action, or hard blocks on anything unfamiliar.

Challenge only when the score says so

Continuous scoring lets you leave the common case untouched. A trusted device, a familiar pattern and a valid passkey mean the user simply proceeds.

A step-up appears only when the trust score falls below the threshold for the action being attempted, which, for most traffic, is almost never.

Designing the drop-off away

Set thresholds per journey rather than per application. Log every decision so you can tune from evidence. Give users a recovery path that does not fall back to a password.