Phishing-resistant authentication at scale still hinges on lifecycle control

At a glance

What this is: This is an analysis of hardware-based, phishing-resistant authentication and the key finding is that scale, not cryptography, is the main implementation bottleneck.

Why it matters: It matters because IAM teams must treat authenticator issuance, renewal, and revocation as lifecycle governance problems across human and non-human access paths, not just as an MFA rollout.

By the numbers:

• 91% of organizations experienced identity-based attacks.
• 60 million smart cards to North America as of April 2023.
• 2,400 enterprises in more than 180 countries world-wide.

👉 Read Axiad's post on phishing-resistant authentication at scale with IDEMIA

Context

Phishing-resistant authentication becomes an identity governance problem once it moves beyond pilots and into mixed estates of users, devices, and platforms. The article's core point is that strong credential technology is not enough if issuance, renewal, account recovery, and revocation cannot be executed consistently across the environment.

For IAM and PAM teams, the real test is whether authenticator lifecycle management can keep pace with hybrid infrastructure, multiple IAM systems, and distributed user populations. That is a human identity problem first, but the same governance pattern applies wherever credentials must be provisioned, renewed, and retired at scale.

Key questions

Q: How should security teams implement phishing-resistant authentication at scale?

A: Security teams should treat phishing-resistant authentication as an identity lifecycle programme, not a login feature. That means standardising enrollment, renewal, recovery, and revocation, then integrating those steps with device management, access reviews, and help desk workflows. Hardware-backed authenticators only reduce risk when the organisation can keep their status accurate across the whole estate.

Q: Why do hardware tokens still need strong identity governance?

A: Hardware tokens still need governance because the token itself can become stale, lost, or misassigned even when the cryptography is strong. The main failure mode is not password theft but unmanaged lifecycle state, where a valid authenticator remains in circulation after access should have changed. Governance keeps the credential estate trustworthy.

Q: When does passwordless authentication create new operational risk?

A: Passwordless authentication creates new operational risk when recovery, replacement, and revocation are not tightly controlled. In that situation, the organisation may remove one weak factor but leave behind inconsistent authenticator state, support bottlenecks, and orphaned credentials. The control question is whether the programme can sustain accurate identity state over time.

Q: How do physical access cards and digital access controls differ in practice?

A: Physical access cards and digital access controls differ because one credential can govern two different domains of risk at once. A lost or reassigned converged card can affect doors and systems together, so revocation must be synchronized across both environments. Teams should verify that one deactivation event closes every access path it opens.

Technical breakdown

Hardware-backed authentication and certificate-based access

Certificate-based authentication uses a private key stored on a hardware token or smart card to prove possession during sign-in. Unlike passwords, the secret never leaves the device, which reduces phishing exposure and makes replay far harder. In the article's model, PIN entry unlocks the token, while the certificate and key establish the trusted authentication event. This is strongest when mapped to FIPS and FIDO-aligned controls, because the assurance comes from the hardware boundary rather than user-chosen memorised secrets.

Practical implication: standardise on hardware-backed authenticators for high-risk users and systems where password reuse and phishing are persistent exposure paths.

Credential lifecycle management at enterprise scale

The operational challenge is not authentication strength but lifecycle handling. Enrollment, renewal, recovery, and revocation must all be automated enough to support thousands of users across Windows, Mac, Linux, on-premises, cloud, and hybrid systems. If these steps stay manual, the programme becomes inconsistent, support-heavy, and vulnerable to stale credentials remaining active after access should have changed. In practice, lifecycle tooling determines whether strong authentication is actually governable.

Practical implication: treat authenticator lifecycle workflows as a control plane, with documented triggers for issuance, renewal, and revocation.

Converged physical and logical identity credentials

The article also describes converged cards that support both physical facility access and digital system access. That convergence reduces card sprawl, but it also increases the blast radius of credential compromise because one credential now mediates more than one access domain. The governance question is not whether convergence is possible, but whether revocation, replacement, and assurance levels are coordinated across both physical and logical systems when the card changes state.

Practical implication: align physical access and digital access governance so one credential event cannot leave a disconnected access path behind.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication strength fails when lifecycle control is weak. The article shows that the hard part is not proving possession with a smart card or hardware token. The hard part is issuing, renewing, recovering, and revoking those authenticators across a heterogeneous estate without creating delay, drift, or stale access. In NHI governance terms, the control failure is lifecycle consistency, not cryptographic weakness. Practitioners should treat provisioning and revocation as the real assurance boundary.

Phishing-resistant authentication does not remove identity attack surface, it changes where the risk sits. Passwordless and certificate-based flows reduce one class of compromise, but they raise the importance of device state, token custody, and recovery governance. If those controls are inconsistent, the organisation may simply relocate risk from password theft to unmanaged authenticators and weak offboarding. The implication is that MFA maturity has to be measured at the lifecycle layer, not just at the login layer.

Converged physical and logical credentials create a broader governance dependency than single-purpose badges. A card that opens doors and grants digital access requires synchronized identity state across two control domains. That is a stronger governance model when well managed, but a larger failure domain when revocation or replacement is fragmented. Practitioners should evaluate convergence as an access-chain issue, not as a convenience feature.

Multi-platform identity estates expose the limits of manual authentication administration. The article is effectively a case for centralised control over a distributed credential estate spanning multiple operating systems and IAM systems. That matters because inconsistency, not absence of controls, is often what weakens strong authentication programmes in practice. The practitioner conclusion is to govern authenticator state as a lifecycle inventory, not as isolated login technology.

Zero trust only becomes credible when authentication governance is operationally repeatable. Strong authenticators can support zero trust principles, but only if the organisation can sustain consistent issuance and revocation as the environment changes. Without that repeatability, the architecture claims outpace the actual control posture. The practical conclusion is to connect authentication design to the same governance discipline used for other privileged identity lifecycles.

From our research:

• 91% of organizations experienced identity-based attacks, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage.
• For a broader lifecycle view, Ultimate Guide to NHIs maps the governance, rotation, and offboarding controls that keep credentials from lingering.

What this signals

Phishing resistance is only durable when authenticator lifecycle state is visible. As environments span endpoints, clouds, and physical access systems, teams need a current view of what is issued, what is expired, and what has been revoked. The governance gap is no longer whether strong authenticators exist, but whether the organisation can prove they are still the right ones in circulation.

Credential convergence increases both efficiency and blast radius. When one card carries physical and logical access, revocation has to be coordinated or the organisation risks leaving a shadow access path behind. That is why lifecycle process design, not just authenticator selection, should sit inside IAM and PAM operating models.

Identity growth makes manual administration unsustainable. NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs, and the same governance pressure shows up in large human authentication estates. If teams cannot scale credential state management, strong authentication degrades into a support burden instead of a control.

For practitioners

• Map authenticator lifecycle ownership to named control points Assign clear owners for enrollment, renewal, recovery, and revocation, then document the event that triggers each one. Tie those triggers to HR, device management, and access review processes so credentials are not left active after role or device changes.
• Automate credential status visibility across the estate Track which authenticators are active, expired, suspended, or lost across Windows, Mac, Linux, and hybrid systems. Use that inventory to find stale credentials and failed revocations before they become access gaps.
• Separate assurance from convenience in token design Decide which populations need hardware-backed phishing resistance and which can remain on lower-assurance flows. Avoid making every user follow the same recovery path when the assurance requirement and support impact differ.
• Align physical badge governance with logical access revocation If a single card controls both doors and systems, make replacement and deactivation a single workflow. Confirm that a lost or reassigned credential removes both facility access and digital access in the same control process.

Key takeaways

• The article's main lesson is that strong authentication fails operationally when lifecycle management cannot keep pace with scale.
• The evidence points to identity attack pressure, not cryptographic weakness, as the reason phishing-resistant authentication matters now.
• IAM teams should measure authentication programmes by issuance, renewal, recovery, and revocation quality, not by token adoption alone.

Key terms

• Certificate-based authentication: Certificate-based authentication is a login method that proves identity using a cryptographic certificate and a private key stored in protected hardware or secure software. In practice, it reduces phishing exposure because the secret is not typed into a password field and can be tied to device and issuer assurance.
• Authenticator lifecycle management: Authenticator lifecycle management covers the processes used to issue, renew, recover, suspend, and revoke authentication credentials. It matters because strong authentication fails when the organisation cannot keep authenticator state aligned with user status, device status, and access entitlement changes across the environment.
• Converged credential: A converged credential is a single identity credential used for more than one access domain, most commonly physical facility access and digital system access. It can simplify user experience and administration, but it also requires synchronized governance so one change in status correctly affects every dependent system.

Deepen your knowledge

Phishing-resistant authentication and lifecycle governance are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building a stronger authentication programme across human and machine identities, it is worth exploring.

This post draws on content published by Axiad: Partner Spotlight on streamlining authentication at scale with IDEMIA. Read the original.