Stop Unauthorized Access With Passkey Passwordless Login for Your Core Business System

It is 11 p.m. on the last Friday of the month. Your accounting lead gets a message that looks like it came from your ERP vendor. It asks her to log in and confirm a setting before close. She types her username and password into a page that looks correct. It is not. By Monday, someone has logged into your core business system, opened the customer list, and started quoting under your name. Nothing in the system was broken. The password simply left the building.

That single scene explains why passkey passwordless login has moved from a nice-to-have to a requirement for any Japanese company running finance, inventory, or sales data in the cloud. The password was the weak point, and the password is the thing you can now remove.

The Password Problem Has Outgrown Japan's Patience

Japan is no longer a quiet target. According to analysis by S&P Global Ratings and IBM, 22 percent of all global cyberattacks observed in 2024 hit Japan, making it the single most targeted country that year. The volume is not theoretical. Japan's National Police Agency tracked a record 1,718,036 phishing incidents in 2024, and the first half of 2025 already surpassed 1.19 million reported cases.

The dominant attack path is the same in nearly every case. An attacker tricks one staff member into typing a password into a fake page, then uses that password to reach the core business system. The strongest firewall, the cleanest backup policy, and the most careful close calendar all fail at that one keystroke. Once an account is open, the intruder looks like a normal user. Approval workflows run. Journal entries post. Orders ship.

Removing the password removes the target. A passkey does not get typed. It cannot be phished, screenshotted, reused on another site, or pulled from a stolen spreadsheet. For a company running its books, its qualified-invoice records, and its customer relationships inside one ERP, that change is the difference between a near miss and a board-level incident.

What a Passkey Actually Replaces

A password is a shared secret. You know it, the server stores something derived from it, and any system in between can try to capture it. A passkey works on a completely different principle. When you register one, your device creates a cryptographic key pair. The private half never leaves the device. It lives inside the secure enclave of a Mac, the trusted platform module of a Windows laptop, or the secure enclave of a phone. The public half is what your ERP stores.

At login, the server sends a one-time challenge, a random string. Your device signs that challenge with the private key and returns the signature. The server verifies the signature against the public key it already holds. If it matches, you are in. If the challenge has expired, or the signature came from a different origin, or the request was replayed, the login fails.

Three properties matter for a business owner. First, there is nothing to steal. The private key is never transmitted, so a phishing site cannot capture it. Second, the challenge is bound to a specific domain, so a look-alike site cannot reuse a response from the real one. Third, the device proves presence. A signature is only produced when a person unlocks the device, with a fingerprint, a face, or a PIN.

For the accounting lead in the opening scene, that means the fake page does not work. Her device signs a challenge for the wrong origin, the signature is rejected, and the attacker walks away empty.

Built-In Passkey Login, Not a Bolt-On

In Kikan System, passkey login is a first-class part of how people sign in, not a third-party widget. Every staff member can register one or more passkeys on the devices they actually use. A common setup is a laptop passkey for the office and a phone passkey for approvals on the road. Each one gets a friendly label, so a user can tell at a glance which credential is which.

The capabilities that come out of the box, grounded in the auth module, are the ones a CFO or operations head actually cares about.

Passwordless registration and sign-in. A user enrolls a passkey through their account settings, and from that point they can log in with biometrics or a device PIN. The password becomes optional, then unnecessary.

Multiple passkeys per user. Staff can register as many passkeys as they have trusted devices. Lose a laptop, disable that one credential, and keep working from a phone. No help-desk ticket, no password reset chain.

Named and managed credentials. Every passkey carries a label the user chooses, such as "Work MacBook" or "iPhone 15", along with the device type and a last-used timestamp. When someone needs to review who can sign in as them, the list is right there.

Discoverable sign-in without a username. For teams that value speed, the login can be username-free. The device presents the right credential for the company automatically. This is the same flow the major platforms use, and it removes one more thing for a busy accountant to type at month-end.

Two-step verification still layered on top. For accounts that need it, passkey login can still require a second factor before the session is fully established. Passkey does not fight two-step verification. It works alongside it.

Rate limiting on every credential step. Registration and login attempts are throttled, so a script cannot hammer the login endpoint looking for a way in. This is defense in depth, not a single locked door.

Active-account checks at sign-in. A disabled or removed login account cannot authenticate even with a valid passkey, because the check happens after the signature is verified. When someone leaves the company, you suspend the account, and every credential tied to it stops working.

Per-company data isolation. Every passkey operation is scoped to one company's data. Each company keeps its data fully isolated, so a credential registered for one group cannot reach another. This matters for holding companies and shared-service setups that run several entities on one platform.

The honest limitation is worth stating. Passkey login protects the front door. It does not replace good operational habits, and it does not by itself produce an immutable audit trail of every action inside the system. For sensitive changes, the system records who approved what and when through its approval-workflow history, which is where most governance questions get answered. Passkey is one layer in a larger security posture, but it is the layer that closes the most common hole.

A Scenario: A Precision Parts Maker in Higashi-Osaka

Consider a precision parts manufacturer in Higashi-Osaka, about seventy staff, supplying stamped and machined components to automotive Tier-1 customers. They run their core business system in the cloud, with double-entry accounting, multi-level bill-of-material management, lot traceability for recall readiness, and the qualified-invoice registration numbers they need to claim input tax credit.

Their pain is familiar. The accounting team of six shares customer and pricing data that must not leak. The plant supervisors log timesheets and scrap from the floor on shared tablets. Sales staff quote from phones while visiting customers in Nagoya and Tokyo. Three years ago, a supplier of theirs lost a customer list when one staffer reused a password across a forum and the ERP. They do not want to be that story.

With passkey login, the setup looks like this. Each accountant registers a laptop passkey and a phone passkey. The plant supervisors enroll the floor tablets with a passkey each, so there is no shared password written on a sticky note. Sales staff use their phones. When the head of accounting leaves her laptop at the office, she signs in from her phone with the same identity, because the credential travels with her, not the machine.

When a salesperson loses a phone, they do not panic. They sign in from another device, open the credential list, and remove the lost phone's passkey. The session on that phone is gone the moment the credential is deleted. No password reset, no email chain, no exposure window measured in days.

When the qualified-invoice system requires them to demonstrate clean access controls to a customer auditor, they can show three things. First, sign-in requires a device-bound credential that cannot be phished. Second, every account is access-granted by role, so an accountant sees the ledger and the plant supervisor sees production orders, and neither sees the other's data. Third, access can be suspended instantly when someone changes roles or leaves.

The result is not a sales pitch about technology. It is a quieter month-end, fewer anxious calls to the IT vendor, and an auditor who nods instead of writes findings.

Why Now: The 2025 Cliff and the Qualified-Invoice Squeeze

The timing is not accidental. Two forces are pushing Japanese companies to rethink access to their core business system at the same time.

The first is the 2025 legacy cliff. According to IPA and METI reporting, roughly 80 percent of Japanese companies still rely on legacy systems, and a large share of those systems are running past their supported life. The companies that are renewing are not just swapping one on-premise box for another. They are moving to cloud ERP, which means their finance and operations data now sits behind a login screen that the whole internet can reach. A password on that screen is a liability the old on-premise setup did not have to the same degree.

The second is the qualified-invoice system and the broader tightening of tax documentation. Companies that claim input tax credit now carry registered numbers, invoice records, and counterparty data that an attacker would love to quietly read or alter. The compliance value of those records collapses the moment someone else can log in as your accountant. Strong, phishing-resistant access is part of what makes the qualified-invoice investment pay off.

There is also a staffing angle. Japan's labor shortage means finance and operations teams are lean and cross-functional. People wear more hats, use more devices, and move between the office, the plant, and customer sites. A login method that follows the person, not the machine, fits how work actually gets done in 2026.

Frequently Asked Questions

What happens if a user loses every device with a passkey?

This is the most common worry, and the answer is operational. Kikan System keeps password-based recovery available for an administrator-assisted reset, and the same role-based access controls govern who can trigger it. The realistic risk is lower than it sounds, because most staff carry at least two devices. The rarer case of a full lockout is a help-desk call, not a security breach.

Is passwordless weaker because there is no second factor?

No. A passkey is itself a strong possession factor paired with a biometric or PIN unlock. It is, in effect, a built-in form of two-step verification that an attacker cannot intercept, because the signature is bound to the real domain and never leaves the device. Many security teams treat phishing-resistant sign-in as a higher bar than a password plus a one-time code sent over a channel that can be SIM-swapped or phished.

Does passkey login slow people down at month-end?

It is faster. Instead of typing a username, a password, and reading a code from a phone, a user authenticates with one biometric prompt and is in. On a shared tablet at the plant, the discoverable flow means the right credential is offered without anyone typing a username at all. The friction moves from the user to the attacker.

Will this break our existing users during migration?

No forced cutover is required. Passkey is an additional sign-in method, so staff adopt it on their own schedule and administrators can keep password login available until the team is comfortable. This staged approach is what makes the change safe for a live finance operation that cannot tolerate a login outage during close. You can roll it out on the free plan, which covers up to 2 users with no credit card required.

Can a suspended user still sign in with a valid passkey?

No. The active-account check runs after the signature is verified, so a disabled or removed login account cannot authenticate even with a valid passkey. When someone leaves the company or changes roles, you suspend the account and every credential tied to it stops working at the door.

Start With the Door That Matters Most

Key Takeaway: Passkey passwordless login removes the single most common path into a core business system, the stolen password, without adding friction for legitimate users. For a company renewing its ERP in 2026, it is one of the highest-value security changes you can make this year.

You do not have to rebuild your security program to close the password hole. You have to choose a core business system that treats passwordless login as a first-class capability, then turn it on for the people who touch your money, your customer data, and your compliance records.

Kikan System ships passkey login built in, with multi-device support, named credentials, discoverable sign-in, rate limiting, and per-company data isolation. You can enroll your finance and operations teams in an afternoon and let them keep passwords as a fallback until they are ready to let go.

See it for yourself. Start free at /#get-started, up to 2 users, no credit card. If you want to map it against your roles and close calendar first, review the options at /#pricing.

The accounting lead from the opening scene deserves a better Friday night. Give her a login that cannot be phished, and the rest of your security stack finally gets to do its real job.

-> Related: Choosing a Core Business System: A Cloud ERP Selection Guide

-> Related: Surviving the 2025 Cliff: A Core Business System Renewal Guide