Hardware security keys and YubiKey for Indian businesses: phishing-resistant MFA, passkeys, what they cost in India, and where they are not needed.
Hardware security keys, YubiKey being the best known example, are worth the cost for any Indian business that runs privileged access, a finance approval path, a domain registrar account or an executive mailbox. A key is phishing-resistant because the credential never leaves the device and the protocol binds to the origin, so a proxied login page captures nothing. The economics are simple: a key costs a fraction of one worker's day of lost time from a business email compromise, and it removes the class of attack behind most Indian impersonation fraud.
Because of where the authentication happens. With an authenticator app, a code is generated on the phone and typed into whatever site asks, so a convincing proxied login page captures it. With a security key, the browser and the key perform a cryptographic exchange bound to the origin, and the credential is never transmitted, so a fake page gets nothing. This property is called phishing resistance and it is the reason a security key is the recommendation for exactly the accounts an attacker wants: the domain registrar, the identity provider, the code repository, the cloud console, and the finance approver's mailbox. The other difference is practical, because a key can be used with a PIN or a biometric for presence, and because a lost key can be revoked centrally and immediately, without an attacker needing your phone.
Five places, in this order, because they are ordered by blast radius. The domain registrar and DNS account, since a takeover there lets an attacker redirect mail and any second-factor enrolment, and it is the single most consequential account in a small business. The identity provider, the mail server and the cloud console, because those administer everything else. Developer and CI accounts, because they hold deployment keys and secrets. The finance and treasury approval path, which is where the documented Indian losses are, including the Rs 10 crore voice-cloned MD case. And the executive mailboxes, since SEBI's 17 July 2026 caution described attackers saving their own number in a victim's contacts under the CEO's name. For ordinary staff, a passkey on the phone gives most of the benefit at no cost.
A compromised machine. If an attacker controls the endpoint, they can wait for the key to be used, or persuade the user to approve one, and the key will do its job correctly. They also do not stop a user from being socially engineered into approving a fraudulent request, because that is a business-process failure rather than an authentication failure, which is why the key deployment should be paired with an out-of-band callback policy on payments. And they do not help if the key is left plugged in and unattended, so the hardware should be locked to a user or carried separately. A security key reduces the value of a stolen password, and it is one part of a set that includes endpoint controls, segmentation and payment approval discipline.
The keys are inexpensive; the cost is enrolment effort and account recovery, which is where programmes fail. Budget for at least two keys per administrator, a documented enrolment and revocation process, a recovery path that does not rely on the key itself, and a small pilot before a fleet-wide rollout. At AAVETech we fold key and MFA deployment into a fixed-price identity and access assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days, producing a written account inventory, a prioritised key deployment list and a recovery procedure. Retention clients are engaged within 4 hours for emergencies and 12 hours otherwise.
| Account | Why it matters | Priority |
|---|---|---|
| Domain registrar and DNS | Lets an attacker redirect mail and enrolment | First |
| Identity provider and mail admin | Administers every other account | First |
| Cloud console and CI | Holds deployment keys and secrets | First |
| Finance approval mailboxes | Direct route to money movement | First |
| Executive mailboxes | Target of documented impersonation fraud | Second |
| Ordinary staff accounts | Passkey on a phone is sufficient | Third |
Hardware security keys, YubiKey being the best known example, are worth the cost for any Indian business that runs privileged access, a finance approval path, a domain registrar account or an executive mailbox. A key is phishing-resistant because the credential never leaves the device and the protocol binds to the origin, so a proxied login page captures nothing. The economics are simple: a key costs a fraction of one worker's day of lost time from a business email compromise, and it removes the class of attack behind most Indian impersonation fraud.
A passkey is a credential stored in a platform keystore, such as a phone or a laptop, and it is discovered by the site rather than by a device you plug in. A hardware security key is a separate physical device with a PIN or biometric for presence. Both are phishing-resistant; the key is more portable across devices and better for shared or high-privilege use.
Yes. Most Android devices support passkeys in the platform keystore today, and USB or NFC security keys work with Android and iOS for sites that support WebAuthn. Where the platform is constrained, a passkey on the phone is a reasonable and much cheaper second step.
It is revoked centrally and immediately from the identity provider, and a spare is issued. That is a material advantage over an authenticator app on a lost phone, where a remote wipe is slower and less certain, and it is the reason administrators should hold at least two keys each.
No, and it is important to be clear about that. A key stops a credential being phished. It does not stop a finance employee being persuaded by a cloned voice to make a legitimate request, which is why the payment approval policy, dual authorisation and out-of-band callback are the controls that address documented cases such as the Rs 10 crore voice-cloned MD fraud in June 2026.
Yes. AAVETech runs a fixed-price identity and access assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, in 5 to 10 working days, producing a written account inventory, a prioritised key deployment list, a recovery procedure and a retest after your changes.
Read the full guide on AAVETech: Are Hardware Security Keys Worth the Cost for an Indian Business?.
Send us your list of privileged and finance accounts and we will return a fixed-price identity and access assessment with a prioritised key deployment plan.
Talk to an analyst about this.