HID's Enterprise Attestation checks a passkey authenticator is company-issued before it can enroll

HID announced Enterprise Attestation on June 5, 2026, a governance layer for its FIDO2-certified authenticators that closes a gap FIDO Alliance research had already identified as a real adoption barrier: passkeys prove a credential is phishing-resistant, but say nothing about whether the device holding it is one the organization actually issued. When a device attempts to enroll a passkey, Enterprise Attestation checks for a certificate tying it to a known, company-issued authenticator; if that certificate is missing or unrecognized, enrollment is blocked by policy. The check runs transparently within standard WebAuthn and CTAP workflows, with no proprietary extensions and no added friction for users on legitimate hardware, and produces an auditable enrollment record useful for compliance with frameworks like NIS2 and DORA.

Why it matters

Passkeys solve the phishing problem but not the shadow-IT problem: an employee registering a personal security key or their phone's platform authenticator is still phishing-resistant, but it's also a credential IT never provisioned, can't revoke through normal offboarding, and can't prove was ever under organizational control. Attestation at enrollment time is the fix, checked once at the door rather than audited after the fact.

For regulated industries specifically, financial services, healthcare, critical infrastructure, "we require passkeys" and "we can prove every passkey came from a device we issued" are different compliance claims, and only the second one satisfies auditors asking about device governance.

Source: FIDO Alliance