94 percent of enterprises say they can revoke access in 24 hours. 35 percent found out they couldn't.

FIDO Alliance and HID launched The State of Physical and Digital Identity in the Enterprise at Identiverse in Las Vegas on June 15, 2026, based on a survey of 500 IT and cybersecurity decision-makers (manager level and above) across the US, Canada, UK, France, and Germany, spanning finance, healthcare, public sector, manufacturing, and technology. The core finding: 94 percent of organizations believe they can revoke both physical and digital access within 24 hours of an employee leaving, yet 35 percent actually experienced a revocation failure in the past two years, and 70 percent had at least one identity-related security incident overall. The public sector had the worst real-world failure rate at 43 percent, with a manual revocation rate double that of the technology sector. On authentication, 93 percent of organizations are somewhere in a passkey rollout, but only 13 percent have deployed passkeys at scale.

Why it matters

The gap between believed and actual revocation speed is exactly the metric that offboarding processes are supposed to close, and self-reported confidence is a bad proxy for it: 94 percent claiming a 24-hour capability next to a 35 percent real failure rate means a third of organizations are trusting a control they haven't actually tested.

The passkey numbers tell a parallel story: rollout intent is nearly universal, but at-scale deployment sits at 13 percent, which lines up with why phishing and session-theft techniques covered elsewhere this week still work at scale. Confirm your own offboarding SLA against a real test, not a policy document, and treat "in progress" passkey rollouts as not yet providing the protection they're credited for.

Source: FIDO Alliance