TL;DR: A widening gap between security perception and actual authentication hygiene is evident in a 2025 global survey of 18,000 employed adults across nine countries, according to Yubico. The practical lesson is that phishing resistance now spans human identity, digital identity, and emerging NHI trust models, not just password replacement, including 70% who say AI has made phishing more successful and 29% who still lack MFA on personal email.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Yubico's blog post: AI-driven phishing pressure is rising while basic MFA adoption still lags in everyday use in 2026 authentication trends.
Why it matters: It matters because IAM and identity leaders now have to treat phishing resistance as a cross-domain governance issue spanning human access, NHI trust, and enterprise verification models.
By the numbers:
- 70% believe phishing attempts have become more successful due to the use of AI.
- 29% still don’t have MFA set up for their personal email accounts.
Context
Phishing resistance is no longer just a user authentication problem. The article argues that AI-assisted phishing, passkey adoption, verifiable credentials, and non-human identity governance are now converging into one identity assurance problem that affects employees, partners, and machine access alike.
Yubico frames 2026 as a transition year in which organisations will have to reconcile stronger authentication with broader identity verification. That shift matters because the same trust assumptions that protect human logins also shape how enterprises think about NHI lifecycle control, digital wallets, and delegated access across business ecosystems.
Key questions
Q: How should security teams reduce phishing success without relying on user vigilance alone?
A: They should move controls into the authentication flow. Domain-aware autofill suppression, paste warnings, MFA, and unique passwords reduce the chance that a momentary lapse becomes a completed compromise. User training still matters, but it should reinforce controls that interrupt credential submission before the secret reaches an attacker-controlled page.
Q: Why does AI-driven phishing change identity security decisions?
A: It lowers the reliability of human judgment in routine trust checks, which means organisations need stronger process controls. Security teams should shift validation into workflow design, use out-of-band verification for sensitive actions, and reduce reliance on user recognition of suspicious content.
Q: When do non-human identities need the same trust controls as human users?
A: When those identities can initiate access, move data, or participate in delegated workflows that affect business systems. At that point, the organisation should govern ownership, verification, lifecycle, and offboarding with the same seriousness it applies to employee access.
Q: What should IAM teams do first after finding a weak MFA implementation?
A: Reassess the exposed population, tighten server-side throttling, and accelerate migration for privileged and externally reachable users. The immediate goal is to remove the easiest bypass path while you redesign the longer-term authentication standard. In practice, that means treating the flaw as both a security incident and an identity design problem.
Technical breakdown
Why AI-driven phishing changes the authentication baseline
AI lowers the cost of persuasion, scale, and personalisation in phishing campaigns, which means legacy awareness training cannot carry the security burden alone. The important shift is not that attacks are new, but that they now arrive with better timing, better language, and more believable context. That makes weak authentication choices far more exploitable, especially where passwords, legacy MFA, and recovery flows still create alternate paths into accounts. For practitioners, the relevant control question is whether the authentication method still resists social engineering when the attacker can automate the social layer as well as the technical one.
Practical implication: move phishing resistance from a user-training goal to an authentication design requirement.
How passkeys and device-bound trust change identity assurance
Passkeys matter because they bind authentication to a device and a credential origin that is harder to phish than shared secrets or OTP-based flows. In practical terms, they reduce replay risk and remove the need for a user to manually type a reusable secret into a potentially hostile context. That does not make identity trust automatic, however. It simply raises the floor for authentication assurance while leaving lifecycle, recovery, and device governance decisions in place. The architecture question becomes whether organisations can standardise on phishing-resistant factors without creating exceptions that reopen the same exposure path.
Practical implication: use passkeys where possible, but govern recovery and exception paths with the same discipline as primary access.
Why NHI governance now sits inside the phishing-resistance discussion
The article’s NHI thread matters because non-human identities increasingly participate in the same trust fabric as human users, partners, and digital wallets. Once bots, services, and delegated workflows are part of the access model, phishing resistance is no longer only about end-user login strength. It also becomes about how organisations prove that machine identities are genuine, scoped, and still under control. That is where governance breaks down if teams treat NHIs as purely technical accounts rather than identities with verification, lifecycle, and offboarding requirements.
Practical implication: extend phishing-resistance governance to machine and delegated identities, not just people.
Threat narrative
Attacker objective: The attacker seeks to gain trusted access that looks legitimate enough to bypass identity checks and enable downstream fraud, intrusion, or impersonation.
- Entry starts with AI-assisted phishing that produces more convincing lures and social engineering at scale, making initial compromise more likely against users still relying on weak authentication.
- Credential access follows when victims can be pushed into password, recovery, or MFA-bypass paths that are easier to social-engineer than device-bound authentication.
- Impact arrives when stolen or misused access is used to impersonate trusted users, manipulate identity-driven workflows, or extend trust into enterprise and supply-chain interactions.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing resistance is now an identity governance discipline, not a single control choice. The article shows that AI is amplifying the pressure on authentication while basic MFA adoption still lags in everyday use. That gap is not just a user-behaviour problem. It is a programme design problem that spans login assurance, recovery paths, and the lifecycle of trusted identities. Practitioners should treat phishing resistance as a governance outcome, not a feature checklist.
Passkeys shift the control plane from shared secrets to device-bound assurance. That matters because phishing succeeds most often where the user can be tricked into presenting something reusable. Device-bound authentication narrows that exposure window and raises the cost of replay and interception. The practical implication is that identity programmes should reduce dependence on fallback methods that weaken the security model they are trying to improve.
Non-human identities cannot remain outside phishing-resistance policy. As enterprises extend trust through bots, workflows, and delegated services, the boundary between human access and machine trust becomes operationally irrelevant. If an organisation hardens employee login while leaving service and delegated identities loosely governed, the programme only moves the weak point. The implication is that NHI governance must be aligned with the same trust standards used for human identity assurance.
Digital identity wallets are becoming an enterprise trust problem, not a consumer novelty. The article’s emphasis on verifiable credentials reflects a broader shift toward high-assurance identity proofs in business-to-business and supply-chain interactions. That changes how identity leaders think about external trust, because verification now needs to extend beyond the organisation’s direct workforce. Practitioners should expect digital identity to become part of enterprise access architecture, not a separate innovation track.
What this signals
Identity assurance is moving from login events to trust ecosystems. The next stage of programme maturity is not simply stronger user authentication. It is a broader model where human access, delegated access, and machine trust all have to survive phishing pressure, recovery abuse, and impersonation attempts.
Verifiable credentials will matter most where trust crosses organisational boundaries. Enterprise identity teams should expect the sharpest demand in partner ecosystems, digital wallets, and high-stakes interactions that cannot tolerate weak proofing. The practical question is no longer whether authentication is strong in isolation, but whether it is verifiable across the full trust chain.
For practitioners
- Prioritise phishing-resistant authentication Replace the highest-risk password and OTP-dependent access paths with device-bound, phishing-resistant methods first, starting with administrators, privileged users, and high-impact business accounts.
- Map every fallback and recovery path Inventory password resets, recovery codes, helpdesk resets, and exception flows because attackers often target the weakest path rather than the primary login method.
- Extend identity policy to non-human access Apply ownership, verification, and offboarding rules to service accounts, automation, and delegated identities so machine trust is not exempt from phishing-resistance governance.
- Define a cryptographic transition plan for post-quantum readiness Create a cryptographic bill of materials and identify which authentication and signing systems will need updates as post-quantum algorithms mature.
- Align external trust with verifiable credentials For partner, vendor, and wallet-based interactions, require proofs that can be verified without relying on user-entered secrets or easily replayed authentication artefacts.
Key takeaways
- AI-assisted phishing is widening the gap between perceived and actual authentication resilience, especially where passwords and fallback workflows still dominate.
- The article’s survey findings show that basic MFA adoption remains uneven even as threat sophistication rises, which creates avoidable identity exposure.
- Security teams should treat phishing resistance as a governance model that includes humans, non-human identities, and delegated trust paths.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on phishing-resistant authentication and weak login flows across human and NHI contexts. |
| NHI-10 — Human Use of NHI | The piece links human authentication behaviour with how organisations trust and govern non-human access. | |
| NHI-03 — Vulnerable Third-Party NHI | The article highlights external trust, partner access, and supply-chain identity verification. | |
| Recommendation — Replace phishable authentication paths with device-bound, phishing-resistant methods and tighten recovery flows. Separate human login assurance from machine identity governance and remove informal human handling of NHI credentials. Apply stronger verification and lifecycle control to third-party identities that extend trust outside the organisation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Phishing-resistant access still depends on governing who can authenticate and what they can reach. |
| Recommendation — Review authentication-backed access entitlements and remove broad permissions that increase post-phish blast radius. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article focuses on replacing weak authenticators and governing recovery paths across identity types. |
| Recommendation — Manage authenticators through lifecycle controls that minimise reuse, fallback exposure, and recovery abuse. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat discussion centres on phishing, credential capture, and account takeover paths. |
| Recommendation — Map phishing scenarios to credential-access tactics and prioritise controls that remove reusable secrets. | ||
Key terms
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Verifiable Digital Credential: A verifiable digital credential is structured identity data that can be checked cryptographically by a relying party. Instead of relying on visual inspection, the verifier validates issuer signatures and presentation rules, which gives the control a clearer trust basis than an image-based document.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 26, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org