Are Hardware Security Keys Worth the Cost for an Indian Business?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

Why are hardware security keys different from an authenticator app?

Because of where the authentication happens. With an authenticator app, a code is generated on the phone and typed into whatever site asks, so a convincing proxied login page captures it. With a security key, the browser and the key perform a cryptographic exchange bound to the origin, and the credential is never transmitted, so a fake page gets nothing. This property is called phishing resistance and it is the reason a security key is the recommendation for exactly the accounts an attacker wants: the domain registrar, the identity provider, the code repository, the cloud console, and the finance approver's mailbox. The other difference is practical, because a key can be used with a PIN or a biometric for presence, and because a lost key can be revoked centrally and immediately, without an attacker needing your phone.

Where should an Indian business deploy keys first?

Five places, in this order, because they are ordered by blast radius. The domain registrar and DNS account, since a takeover there lets an attacker redirect mail and any second-factor enrolment, and it is the single most consequential account in a small business. The identity provider, the mail server and the cloud console, because those administer everything else. Developer and CI accounts, because they hold deployment keys and secrets. The finance and treasury approval path, which is where the documented Indian losses are, including the Rs 10 crore voice-cloned MD case. And the executive mailboxes, since SEBI's 17 July 2026 caution described attackers saving their own number in a victim's contacts under the CEO's name. For ordinary staff, a passkey on the phone gives most of the benefit at no cost.

What do hardware keys not protect against?

A compromised machine. If an attacker controls the endpoint, they can wait for the key to be used, or persuade the user to approve one, and the key will do its job correctly. They also do not stop a user from being socially engineered into approving a fraudulent request, because that is a business-process failure rather than an authentication failure, which is why the key deployment should be paired with an out-of-band callback policy on payments. And they do not help if the key is left plugged in and unattended, so the hardware should be locked to a user or carried separately. A security key reduces the value of a stolen password, and it is one part of a set that includes endpoint controls, segmentation and payment approval discipline.

What does a security key programme cost an Indian business?

The keys are inexpensive; the cost is enrolment effort and account recovery, which is where programmes fail. Budget for at least two keys per administrator, a documented enrolment and revocation process, a recovery path that does not rely on the key itself, and a small pilot before a fleet-wide rollout. At AAVETech we fold key and MFA deployment into a fixed-price identity and access assessment at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, delivered in 5 to 10 working days, producing a written account inventory, a prioritised key deployment list and a recovery procedure. Retention clients are engaged within 4 hours for emergencies and 12 hours otherwise.

What are the common questions about Y?