A security key is a small hardware device — a USB stick for your login — that stores cryptographic credentials and confirms your identity when you sign in. You plug it in or tap it, press its button, and the sign-in completes with a cryptographic proof that is cryptographically bound to the genuine website. Unlike a code from an app or an SMS, a security key cannot phish, cannot be typed into a fake page, and cannot be intercepted in transit — which is why security agencies including CISA call hardware-backed authentication the gold standard for phishing-resistant MFA. For a small business, a security key is the fastest way to put agency-grade protection on the few accounts that matter most: email admin, banking, payroll, the password manager vault.
TL;DR
- A security key is a hardware device that signs your logins cryptographically — the strongest form of MFA you can buy.
- It is phishing-resistant by design: a fake login page cannot extract a usable credential from it.
- Keys follow the FIDO standard and work with Google, Microsoft, password managers and most major services.
- The cost is a one-time hardware purchase — typically tens of dollars per key — not a subscription.
- Best practice is two keys per protected account: one on the ring, one in the drawer.
What a security key actually does at sign-in
When you sign in with a security key, the website sends a challenge; the key signs it with a private credential that never leaves the device, and the service verifies the signature against what it registered when the key was set up. Nothing secret travels over the network, and the signature only validates for the exact domain the key was registered on. A criminal who builds a perfect clone of your Microsoft 365 login page gets nothing — the key simply refuses to sign for a domain it does not know.
That mechanism is the same one behind passkeys: in fact, a security key is where passkeys can live when they are not synced to a phone. The difference is custody — a synced passkey lives in a credential manager, while a security key keeps the credential in physical hardware you can hold, carry and lock away.
Security key vs authenticator app vs SMS code
| Method | Phishing resistance | Works offline | Weakness |
|---|---|---|---|
| SMS code | None | No | SIM swap, interception, replays |
| Authenticator app (TOTP) | Partial | Yes | Code can be read or phished in real time |
| Push approval | Partial | No | MFA fatigue — approval spam |
| Security key (FIDO) | Strong | Yes | Physical device — carry it, register a backup |
The table is why CISA's guidance on implementing phishing-resistant MFA puts hardware-backed FIDO authentication at the top of the stack (CISA fact sheet). Every method above it can be defeated by a phishing page or a prompt-spam attack; the key cannot.
Where a security key earns its cost for a small business
You do not need a key for every login — the return concentrates on the accounts that unlock everything else:
- Admin and break-glass accounts. The global administrator on Microsoft 365 or Google Workspace, and the recovery account that exists for when MFA fails.
- Finance. Banking portals, payroll, and the accounting platform that holds supplier payment details.
- The password manager vault. Whoever holds the master credential holds every other credential — protect the vault with hardware.
- The owner's and finance staff's everyday accounts. The people attackers impersonate and target first.
Two keys per protected person is the working standard: one on the keyring, one stored securely in the office as backup. Losing the primary should cost minutes, not an account recovery crisis.
Setting up security keys, step by step
- Buy FIDO2-certified keys from a mainstream vendor (YubiKey, Google Titan and equivalents) — two per protected account holder, USB-C or USB-A to match the fleet.
- Register them in the account's security settings. Microsoft 365, Google Workspace, and password managers all support FIDO security keys natively; registration takes a couple of minutes per key.
- Keep a second method registered during transition — the app code or the synced passkey — so a lost key on day one is not a lockout.
- Label and store the backups. The backup key goes in a safe or locked drawer with a note of which accounts it protects; the primary goes on the ring.
- Add keys to the offboarding checklist. Keys are hardware: they come back on the employee's last day and get wiped and reissued.
- Train the moment of use. The prompt says "insert your security key" — staff should know that a site asking for the key that they never registered is a red flag to report, and that the key itself cannot be "reset" by a caller, however convincing. The help-desk impersonation pattern documented by CISA targets resets and enrolments, so enrolment changes should require the manager's confirmation (CISA advisory AA23-320A).
What security keys do not fix
- Physical loss. A key lost with nothing registered in its place means a recovery process — the two-key rule and a documented recovery path are part of the purchase, not an optional extra.
- Shared accounts. A key is personal; a login four people share needs either four registered keys or a managed alternative.
- Non-login attacks. Invoice fraud, vendor impersonation and phone scams never reach a login page — training and payment verification still carry those.
- Old services. Some line-of-business tools do not support FIDO yet; for those, keep app-based MFA and move to keys when the vendor adds support.
A security gap assessment will surface exactly which accounts still rely on SMS codes — usually the clearest signal of where keys go first.
FAQ
What is a security key in simple terms? A small USB device that proves it is really you at sign-in with cryptography instead of a typed code. Plug it in, tap it, and the login completes — and a fake website cannot trick it.
Is a security key better than an authenticator app? For phishing resistance, yes. App codes can be phished one at a time; a key's credential is bound to the genuine domain and never leaves the hardware. Apps are still far better than SMS.
What happens if I lose my security key? You sign in with the backup key or the fallback method, and the administrator de-registers the lost key from the accounts it protected. This is why two keys per person is the standard setup.
Do security keys work with Google and Microsoft accounts? Yes — both support FIDO2 security keys natively, including for administrator accounts, as do most password managers and major business platforms.
How much do security keys cost? Typically tens of dollars per key as a one-time purchase — two keys per protected person is a one-off hardware cost, not a subscription.
Can a security key be phished? No. The key only signs challenges from the exact domain it was registered on, and its credential never leaves the device. This is the property that makes it the strongest MFA method available.
One last thing
Pick the single account that unlocks your business — the email admin console is the usual answer — and order two FIDO2 security keys this week. Registering them takes minutes, and it converts your most targeted account from phishable to effectively unphishable.