Intercede Brings Passkeys to the Windows Desktop, and That Changes the Passwordless Math

On October 12, 2026, the British cybersecurity firm Intercede announced the launch of MyID Authenticate, a platform that brings FIDO passkeys to the places where passwords still refuse to die: the Windows desktop, the VPN, and the legacy application. The announcement, filed through the London Stock Exchange's RNS service, frames the product as a single platform for phishing-resistant sign-in across governments and enterprises. It is launching with a major European public-sector digital services organisation as its lead customer, and version 2026.1 is available now.

The international debut lands this week. Intercede will demonstrate the product at GovWare 2026, the Asia-Pacific cybersecurity event running October 13 to 15 at the Sands Expo and Convention Centre in Singapore, where visitors can try signing in to Windows with a passkey for themselves.

This launch matters less as a product announcement than as a sign of where passkey adoption stands. Passkeys have won the argument: every major platform supports FIDO2 credentials, which are phishing-resistant by cryptographic design because each credential is bound to the genuine site or app it was created for. The browser is conquered territory. The desktop, the helpdesk, and the aging on-premise system are the new front.

The last mile of the passwordless dream

Ask any chief information security officer whether they want passkeys and the answer is yes. Ask them whether their whole estate runs on passkeys and the answer is a tired laugh. For years the practical ceiling was the handful of modern web apps that supported FIDO2 out of the box. Everything else, the Windows domain logon, the VPN concentrator, the payroll system last updated when flip phones were new, still ran on passwords and one-time codes. Both can be phished, and attackers know it.

That gap is exactly what Intercede is selling into. MyID Authenticate works as both a FIDO authentication server and a passkey issuer, and its centerpiece is Passkey Windows Logon, native sign-in to Windows 10 and 11 with a passkey, including when the device is offline. Support for FIDO2 security keys covers both device-bound passkeys that never leave the hardware and synced passkeys that roam across a user's devices, with self-service enrollment so IT departments do not have to touch every workstation.

For everything beyond the desktop, the platform leans on open standards. SAML 2.0 and OpenID Connect extend the same passkeys to cloud and on-premise applications, with federation into Microsoft Entra ID and Microsoft 365. RADIUS support covers VPNs and legacy systems, which is the unglamorous plumbing where most breaches actually begin. The software can be deployed on-premise, in the cloud, or hybrid, and existing MyID MFA customers get a migration tool to move across.

"Everyone agrees passkeys are one of the strongest defences against phishing. The hard part has been getting them onto every desktop and into every modern application. That is exactly what MyID Authenticate does." - Dan McLoughlin, Chief Product Officer, Intercede

Why the enterprise has been slow

The technical case for passkeys has been settled for years. The organizational case is messier. Rolling out phishing-resistant authentication is not a software install; it is a negotiation with every team that owns a login. The Windows domain is often the last fortress, because it underpins everything from file shares to printer authentication, and because breaking logon for thousands of employees on a Monday morning is a career-limiting event.

This is why the offline detail matters more than it looks. Many government and defence deployments involve field laptops, air-gapped machines, and shift workers in places with no reliable connectivity. A passkey solution that only works with a live internet connection is a non-starter for them. Offline Windows logon removes one of the most persistent technical objections, and it is notable that Intercede's lead customer is a European public-sector digital services organisation, the exact kind of buyer with those constraints.

There is also the human factor. Self-service enrollment sounds like a feature bullet, but in practice it is the difference between a pilot that succeeds and a rollout that stalls at five hundred users while the helpdesk drowns. When the security tool creates support tickets instead of removing them, IT leadership kills it. Vendors that have actually shipped enterprise identity products know this; the ones that treat enrollment as an afterthought usually do not survive the pilot.

The fine print, read carefully

Two caveats deserve attention. First, the customer. Intercede announced a lead customer but did not name it. Trade coverage has described both a "major European public-sector digital services organisation" and a first new-logo customer in Germany for the combined MyID CMS and Authenticate offering. These may be the same buyer, but neither version names the organisation or states the deployment size. An unnamed lead customer is not evidence against the product, but it is a reminder that enterprise announcements are marketing until deployments are real.

Second, the quantum claim. Intercede describes the product as crypto-agile and says it supports post-quantum cryptography, and its launch messaging frames the product as phishing-resistant today and quantum-ready tomorrow. The public materials do not name any specific post-quantum algorithm, implementation, or certification. "Designed to support" is a plan for the future, not a description of what a deployment uses today. Buyers with genuine post-quantum requirements should ask exactly which algorithms are used, in which components, before treating the claim as fulfilled.

These caveats aside, the direction is clear. The largest identity vendors all now treat passkeys as the default destination, and the competition has shifted to who can bring the whole estate along, including the parts nobody wants to touch. The race is no longer about convincing anyone that phishing is the problem. Compromised credentials remain the number one cause of data breach, which Intercede knows well from its two decades in the identity business. The race is about the last mile, and the last mile runs through the Windows desktop.