How should organisations update authentication strategies to reduce risk from AI-driven phishing in 2025?

Organisations should move away from weak, user-replayable factors and adopt phishing-resistant authentication as the default for workforce and consumer access. That means prioritising passkeys and security keys, reducing reliance on SMS OTP, and designing enrolment flows that users can complete without friction. The goal is to remove human error from the attacker path, not just add another prompt.

Why Authentication Needs to Change for AI-Driven Phishing

AI-generated phishing has changed the economics of deception. Messages are now better written, more personalised, and more adaptive across email, chat, voice, and SMS, which means organisations can no longer rely on users spotting awkward wording or obvious mistakes. The practical answer is to reduce the value of stolen prompts, one-time codes, and password resets by making the default authentication path resistant to replay and social engineering. That is why phishing-resistant methods matter now, not as an upgrade for high-risk users only, but as the baseline for broad access.

This shift is less about “stronger passwords” and more about removing attacker leverage from the login journey. Standards bodies increasingly point organisations toward modern authentication controls that reduce credential replay and interception, while practitioner guidance from NIST Cybersecurity Framework 2.0 reinforces the need to adapt identity controls as threats evolve. In practice, many security teams discover the weakness only after an employee approves a convincing lure or shares a code that the attacker can immediately reuse.

How It Works in Practice

The most effective update is to make phishing-resistant authentication the default for both workforce and consumer journeys where the risk justifies it. Passkeys and hardware-backed security keys bind authentication to the legitimate origin and device, which makes them far harder to relay than passwords or SMS OTP. That changes the attacker problem from “trick a person into giving me a code” to “break the cryptographic trust boundary,” which is a much higher bar.

Implementation usually starts with the highest-value paths: admin access, remote access, privileged applications, finance workflows, customer support consoles, and any account recovery flow that can reset access to critical systems. Organisations should also review enrolment and recovery, because phishing-resistant login can still be undermined if a weak fallback path remains. If a user can enroll a new factor after answering knowledge-based questions, receiving an SMS code, or convincing support staff, the attacker may simply bypass the stronger login method.

Prefer passwordless or passkey-first journeys for new registrations and step-up authentication.
Allow security keys where device portability, shared workstations, or regulated access justify them.
Minimise SMS OTP and other replayable factors, especially for account recovery.
Bind recovery to stronger proofing, not to the same channel the attacker is already using.
Test for user friction early, because weak adoption often pushes people back to insecure fallback paths.

NHI and credential governance still matter because phishing campaigns increasingly aim at anything that can be reused, forwarded, or delegated. NHIMG’s research on compromised non-human identities shows how often organisations underestimate the blast radius of stolen credentials, with one recent report finding that 72% of organisations have experienced or suspect a non-human identity breach. The same logic applies here: once an authentication secret is reusable, the attacker can often move faster than the help desk can react. These controls tend to break down when legacy applications, third-party identity brokers, or recovery workflows still depend on shared secrets or SMS-based fallback.

Common Variations and Edge Cases

Tighter authentication often increases rollout complexity, so organisations have to balance phishing resistance against adoption, support volume, and application compatibility. Consumer-facing services usually need more migration flexibility than internal systems, while regulated or privileged environments can usually move faster. Best practice is evolving on whether every user must be passkey-only immediately, but there is no universal standard for forcing a single method across all contexts.

Some edge cases need different treatment. Shared devices, call centres, break-glass accounts, and legacy systems may require a controlled exception path, but those exceptions should be narrow and time-bound. Recovery is the biggest hidden risk: if an organisation makes sign-in strong but leaves account recovery weak, it has only moved the attacker to a softer target. Likewise, step-up authentication should be tied to real risk signals rather than applied uniformly, or users will learn to treat every challenge as routine.

Risk and Threat Considerations

The main risk is not just credential theft, but scalable trust abuse. AI-driven phishing improves the attacker’s ability to obtain reusable factors, impersonate support channels, and exploit fallback authentication paths that were designed for convenience rather than resistance to social engineering.

Failure mechanism: A user is convinced to reveal a password, OTP, or recovery code, or is routed into an authentication flow that can be replayed or reset through a weaker channel. The attacker then uses that captured secret before detection or rotates into account recovery to persist access.

Impact: The result can be account takeover, session hijack, privileged access abuse, and downstream compromise of customer data, internal systems, or administrative workflows. The danger increases when one successful phishing event unlocks multiple services through single sign-on or shared recovery paths.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	5 — Account Management	Phishing-resistant auth depends on tighter account lifecycle and fallback control.
Recommendation — Harden account lifecycle and remove weak recovery paths that bypass stronger authentication.
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	The question is fundamentally about modernising authentication to reduce impersonation risk.
Recommendation — Adopt phishing-resistant authentication and phase out replayable factors as the default.
NIST Zero Trust (SP 800-207)	4.2 — Policy Decision Point	Adaptive authentication should rely on real-time policy decisions and context.
Recommendation — Use context-aware policy evaluation to step up or block access when risk changes.
NIST SP 800-63	AAL3 — Authenticator Assurance Level 3	Phishing-resistant authenticators align with the strongest assurance level for sensitive access.
Recommendation — Require phishing-resistant authenticators for high-risk and privileged authentication flows.
MITRE ATT&CK	T1566 — Phishing	AI-driven phishing is an updated delivery method for a core adversary tactic.
Recommendation — Map phishing lures to T1566 and tune detections for impersonation and replay abuse.

Practitioner Guidance

What to prioritise: Start with the accounts and workflows where compromise would create the largest blast radius: administrators, finance, support, executives, and recovery paths. If those are still protected by replayable factors, the organisation remains highly exposed even if ordinary users have a stronger option.

What to verify: Confirm that recovery, enrollment, and help-desk procedures cannot be used to downgrade authentication strength. A strong sign-in method loses much of its value if support staff can reset access through a weaker verification channel or a user can re-enroll on the basis of an intercepted code.

Practitioner takeaway: The real objective is to make stolen authentication material useless quickly enough that AI-generated persuasion no longer converts into account takeover at scale.