Definition

Device-Bound Credential

A cryptographic key or authentication credential that is generated inside a hardware enclave on a specific device and physically cannot be copied, exported, or used on any other device. In contrast to passwords (which exist in memory and can be transmitted), device-bound credentials never enter general purpose memory - they can sign data but cannot move. The possession factor in authentication is therefore the device itself rather than a secret that can be stolen. This model underlies passkeys, Apple Pay, tap-to-pay credit cards, and Beyond Identity's authentication platform. Jasson Casey's key insight: since 80% of security incidents trace back to credentials that can move - passwords stolen, tokens copied, session cookies hijacked - device-bound credentials break the dominant attack chain at the architecture level rather than at the detection level.