TL;DR: Gen Z is the most susceptible demographic to phishing, with 62% reporting a scam encounter in the past year, according to Yubico, and the article argues that accessible phishing-resistant authentication and hands-on education are needed to close the digital safety gap. That matters because identity programmes fail when stronger controls remain unavailable to the users most likely to be targeted.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Yubico's blog post: Closing the Gen Z phishing gap requires phishing-resistant keys, education, and community access, anchored by a survey finding that 62% of Gen Z reported scam engagement in the past year.
Why it matters: It matters because identity programmes that stop at enterprise staff controls miss a growing user segment that needs usable phishing-resistant authentication and practical guidance before unsafe habits become normal.
By the numbers:
- Gen Z remains highly exposed to phishing, with 62% reporting engagement with a scam in the past year, according to Yubico.
Context
Gen Z phishing exposure is not just a consumer safety issue. It is an identity access problem in which the strongest authentication controls are often unavailable, unfamiliar, or too difficult to adopt at the moment when users are most likely to be targeted.
Yubico frames the issue through a youth-access programme rather than an enterprise deployment. That distinction matters for IAM teams because adoption, usability, and education are part of control effectiveness, not afterthoughts.
The underlying gap is between phishing-resistant authentication as a security standard and the communities that rarely receive it early enough. When users build account habits without that baseline, later IAM rollouts inherit the risk.
Key questions
Q: How should teams deploy phishing-resistant authentication for younger or first-time users?
A: Start with the users who are most likely to be lured by phishing and make the strongest factor easy to enrol, understand, and recover. The control only reduces risk when onboarding, device access, and plain-language guidance are available at the moment identity habits are formed, not after.
Q: Why does phishing-resistant authentication still fail if users are not trained?
A: Because the control protects the account, but training protects the decision to trust a prompt, link, or request. Without simple education, users may bypass the strongest option, mis-handle recovery, or fall back to unsafe habits. Authentication strength and user understanding have to move together.
Q: What are the signs that a phishing protection programme is not reaching the right users?
A: Look for uneven enrollment, low repeat use, confusion during setup, and users who still rely on passwords or OTP codes after security keys are available. If the highest-risk group cannot consistently use the control, the programme has a coverage problem rather than a technology problem.
Q: Should identity teams treat youth access and workforce access the same way?
A: No. Workforce IAM assumes managed onboarding, owned devices, and formal support channels, while youth and first-time users often need a simpler access path and more guidance. If the delivery model is different, the identity governance model should be different too.
Technical breakdown
Why phishing-resistant authentication changes the failure mode
Phishing-resistant security keys change the attack from credential theft to possession of a hardware-bound authenticator. Unlike passwords or OTP codes, keys tied to the origin and user presence do not hand an attacker reusable secrets after a successful lure. That matters because phishing succeeds when authentication factors can be replayed elsewhere. In practical terms, the control is only effective if the user can obtain, understand, and consistently use the key in daily account flows. Practical implication: treat usability and distribution as part of the authentication control, not as separate program work.
Practical implication: treat usability and distribution as part of the authentication control, not as separate program work.
What the Gen Z phishing gap says about identity lifecycle
Identity lifecycle controls are usually designed around employees, students, or customers already inside a managed environment. Teens and young adults often sit outside those standard onboarding paths, so they may never receive phishing-resistant authentication at the point where bad habits form. That creates a governance gap: the control exists, but the population most at risk is never enrolled into it. For IAM teams, the issue is not only technical enablement but lifecycle reach, especially where community programmes, schools, or youth centres become the first viable channel. Practical implication: extend identity lifecycle thinking beyond the enterprise perimeter.
Practical implication: extend identity lifecycle thinking beyond the enterprise perimeter.
How education supports control adoption in practice
Education matters because authentication controls fail when users do not understand what problem they solve. Hands-on setup guides, demos, and youth-friendly materials reduce friction and help people recognise phishing attempts before a login decision is made. This is especially relevant for younger users who are simultaneously learning account hygiene, device safety, and social engineering awareness. The control layer and the awareness layer reinforce each other: one protects the account, the other protects the decision to trust a prompt, link, or request. Practical implication: pair phishing-resistant access with simple, repeated user guidance.
Practical implication: pair phishing-resistant access with simple, repeated user guidance.
Threat narrative
Attacker objective: The attacker wants reusable account access or impersonation capability that can be monetised through takeover, fraud, or further phishing.
- Entry begins with a phishing lure that reaches a young user through the channels they use daily and attempts to redirect them to a fake login or scam flow.
- Credential harvesting succeeds when the victim submits reusable authentication data or approves a fraudulent request that an attacker can replay.
- Impact follows as the attacker can take over accounts, impersonate the user, or continue fraud with credentials that were never meant to survive the first lure.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing-resistant authentication only works when it reaches the user before bad habits form: The control problem here is not whether hardware-backed authentication is stronger, but whether the strongest option is available early enough to shape account behaviour. A youth programme that pairs access with hands-on guidance closes the gap between capability and adoption. The practitioner lesson is to treat deployment timing as part of assurance.
Digital identity programmes fail when security assumes enterprise onboarding patterns: The article exposes a lifecycle mismatch. Standard IAM rollouts expect managed devices, managed accounts, and a controlled introduction to MFA, but young users often encounter identity and phishing risk outside those conditions. The implication is that access governance has to account for first-touch identity education, not just later enforcement.
Phishing-resistant keys are a usability programme as much as an authentication programme: Strong factors do not govern behaviour by themselves. If users cannot understand when to use them or how to recognise a phishing prompt, the control remains underused. The practitioner implication is that account protection, user confidence, and safe habit formation should be designed together.
Identity security for teens is a leading indicator for broader consumer IAM resilience: The same usability and trust issues that affect young users also surface in consumer identity, family accounts, and first-time digital services. The market signal is that authentication strategy cannot be restricted to workforce identities alone. Practitioners should expect future IAM expectations to include accessible, explainable phishing resistance by default.
Accessible security is now a governance issue, not a goodwill issue: The article frames distribution and education as part of protection, which is the right way to think about it. If the safest control is reserved for users who already know how to ask for it, the programme leaves the highest-risk population exposed. The implication is that identity governance must measure availability and adoption, not just control selection.
What this signals
Accessible authentication is becoming part of identity strategy, not a side programme: Young users and first-time digital citizens are often the places where weak habits are set. If security teams wait until later lifecycle stages to introduce phishing-resistant access, they inherit users who have already learned unsafe patterns and account recovery behaviours.
Phishing-resistant keys work best when distribution, education, and support are treated as one control: Hardware alone does not close the gap. Practitioners should expect the next phase of identity governance to measure not only whether strong factors exist, but whether the intended population can use them without friction.
For practitioners
- Map first-touch identity education into access strategy Identify where new or younger users first form account habits, then make phishing-resistant authentication and plain-language guidance available at that entry point.
- Pair strong authentication with hands-on setup support Provide step-by-step onboarding, live demonstrations, and simple recovery guidance so the user can adopt the control without guessing how it works.
- Measure who can actually use your strongest factor Track not only enrollment but practical use, comprehension, and repeated adoption across user groups that are most exposed to scams.
- Treat youth and first-time users as a distinct identity segment If your programme serves students, families, or community users, design a separate access and education path rather than reusing workforce MFA assumptions.
Key takeaways
- The article ties Gen Z phishing exposure to a broader identity gap: stronger authentication is available, but not always to the users most at risk.
- Phishing-resistant security keys reduce replayable credential risk, but only when users can adopt and understand them early in their digital lifecycle.
- For practitioners, the control question is shifting from whether phishing-resistant auth exists to whether it is reachable, usable, and taught well enough to change behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on phishing-resistant authentication for users exposed to scam-driven account compromise. |
| NHI-10 — Human Use of NHI | The article focuses on people using hardware keys correctly, which is the adoption side of NHI control effectiveness. | |
| Recommendation — Apply phishing-resistant authentication to replace replayable login factors in high-risk user populations. Design enrolment and guidance so users can operate security keys correctly in real account workflows. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | Phishing-resistant authenticators and user authentication guidance are directly relevant to the control choice here. |
| Recommendation — Use phishing-resistant authenticators where fraud and phishing exposure justify stronger authentication assurance. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article speaks to access assurance and user authentication as part of protective identity controls. |
| Recommendation — Align authentication controls to the access assurance needed for users most exposed to phishing. | ||
Key terms
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
- Identity Lifecycle Event: A business event that changes a person’s access, obligations, or record status, such as hiring, role change, or offboarding. In HR programmes, these events often drive entitlement changes and evidence requirements, so they need to be governed as part of the identity lifecycle rather than handled as isolated paperwork.
- Security Key Adoption: The practical ability of users to obtain, set up, and consistently use a phishing-resistant authenticator. Adoption is not just distribution, but also comprehension, repetition, recovery, and confidence in real account flows.
- Phishing Exposure: Phishing exposure is the degree to which users and email systems are vulnerable to deceptive messages that steal credentials or trigger malicious actions. Strong filtering, user awareness, and verification controls reduce this risk. Weak defenses make social engineering a far easier path into the environment.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 26, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org