Phishing-resistant MFA is now the baseline for identity security

At a glance

What this is: Axiad says phishing-resistant MFA should now be treated as the baseline for identity security because passwords remain weak, phishing is rising, and attackers can exploit stolen credentials across devices and accounts.

Why it matters: It matters because IAM teams cannot rely on passwords and conventional MFA prompts to protect human access, and the same phishing patterns also expose broader identity governance gaps across devices, sessions, and user behaviour.

By the numbers:

• In 2018, there were over 1.3 billion phishing attempts, and that number is expected to grow to over 10 billion by 2022.

Context

Phishing-resistant MFA is an authentication approach that makes it much harder for attackers to use stolen credentials, replayed logins, or social engineering to impersonate a user. The article frames this as a response to a simple governance problem: passwords remain a weak control plane for access, and conventional MFA does not always stop phishing-driven account takeover.

For IAM teams, the issue is not whether MFA exists but whether the authentication method can withstand modern phishing tradecraft. That matters across human identity programmes, because the same compromised login can expose personal devices, corporate accounts, and downstream access paths that were assumed to be trustworthy once the user signed in.

Key questions

Q: How should security teams reduce phishing risk in MFA without creating more user friction?

A: Use phishing-resistant authentication for the highest-risk access first, then phase out phishable factors such as SMS, email links, and push approvals. Bind access to a device or cryptographic key, and keep fallback paths tightly controlled. The goal is not zero friction at any cost. It is to move friction away from the attacker and toward the rare recovery case.

Q: Why do passwords and basic MFA still leave organisations open to account takeover?

A: Because they verify a secret or device, not the trustworthiness of the enrolled identity. If a synthetic or stolen identity gets through registration, the account can authenticate perfectly and still belong to the wrong subject. The failure begins at onboarding, then shows up later as account takeover.

Q: What are the signs that an insurer's authentication approach is too easy to phish?

A: Common warning signs include reliance on SMS, OTP, or push approvals for remote workers, partners, contractors, and privileged accounts. If authentication can be completed with secrets that can be copied, relayed, or socially engineered, the control is not truly phishing resistant. Another signal is when the same login experience is used for high-risk users and ordinary users without stronger assurance steps.

Q: What should teams do when phishing-resistant MFA is in place but fraud still occurs?

A: Teams should inspect the identity journey around the MFA control, especially recovery, enrolment, help desk intervention, and account takeover escalation. Fraud after strong MFA often means the attacker bypassed the login control entirely. The right response is to treat the incident as a lifecycle failure, not just an MFA failure.

Technical breakdown

Why passwords and conventional MFA still fail against phishing

Passwords remain vulnerable because they can be guessed, reused, shared, stolen, or phished, and attackers can automate attempts across many accounts through spraying and credential stuffing. Phishing-resistant MFA changes the trust model by binding authentication to a stronger factor that is harder to replay or counterfeit in transit. The technical point is not simply adding another prompt, but reducing the attacker’s ability to turn a captured secret into valid access. Practical implication: Teams should stop treating any factor that can be phished or replayed as equivalent to phishing-resistant authentication.

Practical implication: Prioritise authentication methods that cannot be easily relayed, copied, or reused by an attacker.

How phishing turns identity into an attack path across devices and accounts

The article makes clear that phishing is no longer just an email problem or just a corporate account problem. Stolen credentials can reach personal phones, tablets, SaaS accounts, and IoT-connected access paths, which means one compromised login can cross from personal exposure into enterprise risk. This is why phishing-resistant MFA matters as an identity boundary control rather than a narrow login feature. Practical implication: Security teams need to model where employee-held credentials can touch business data outside the managed device boundary.

Practical implication: Map user access paths across devices and SaaS services, then remove reliance on phishable login methods.

Why passwordless and frictionless authentication change the control equation

The article links user experience directly to security because if an authentication method is cumbersome, employees are more likely to work around it through sharing, reuse, or informal bypasses. Passwordless and low-friction methods reduce that behavioural pressure while also shrinking the attack surface created by memorised secrets. In other words, good UX is part of the control design, not a separate concern. Practical implication: IAM teams should evaluate phishing-resistant MFA as both an access-control upgrade and a way to reduce user-driven exceptions.

Practical implication: Design authentication so users are less likely to bypass controls in day-to-day work.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant MFA is now a baseline control, not an advanced option. The article reflects a wider identity reality: if authentication still depends on secrets that users can type, share, or be tricked into revealing, the programme is exposed by design. The practical shift for identity governance is to treat phishing resilience as the minimum acceptable property of interactive access, not a premium enhancement.

Password reuse creates identity attack surface that MFA alone does not fully erase. A second factor helps, but the article is right to focus on how weak primary credentials and user habits remain the first point of failure. That means IAM programmes have to govern the whole login path, not just add a second control after the password. Practitioners should assess where password-based access still survives in high-value workflows.

Phishing-resistant MFA closes the gap between security policy and user behaviour. Controls fail when they ask users to do something too awkward to sustain, especially across personal and work devices. A control that users accept is more durable than one they route around, which is why usability belongs in identity design. The implication is that governance teams should measure adoption friction as part of access risk.

Phishing has become an identity problem that extends beyond the login screen. Once a credential is captured, the consequences move across SaaS, mobile devices, and adjacent accounts that were assumed to be separate. That is why the identity security boundary now includes device context and user workflow, not just authentication events. The programme question is whether access controls still match how people actually work.

Phishing-resistant MFA should be treated as part of identity attack-surface reduction. The strongest framing here is not that MFA adds one more layer, but that it removes a common path attackers use to convert deception into access. In practice, identity teams should think in terms of reducing the number of exploitable authentication paths, especially where credentials are reused or exposed through multiple channels.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Phishing-resistant MFA changes the default assumption behind access governance. When login can be copied, relayed, or stolen, the identity programme is defending an authentication method rather than a trust relationship. That is why teams should re-evaluate every place where a password still gates access to sensitive systems, especially when users can reach those systems from unmanaged devices.

Identity teams should treat user workarounds as a control failure signal. If employees share passwords, resist MFA, or ask for exceptions because the process is too cumbersome, the control is not operating as intended. The programme signal is not just whether MFA exists, but whether it is strong enough and usable enough to survive real working conditions.

Phishing-resistant MFA is most effective when paired with broader access reduction. Strong authentication reduces one major path to compromise, but it does not fix excessive privilege, poor account lifecycle hygiene, or weak device governance. Practitioners should use the authentication change to review which access paths can be removed, not just protected.

For practitioners

• Prioritise phishing-resistant authentication for high-value access Move the most sensitive workforce, admin, and remote access flows onto methods that resist phishing, replay, and credential capture. Start with accounts that can reach finance, customer data, privileged administration, or cloud consoles.
• Eliminate password-only login paths Inventory remaining password-based sign-ins across apps, VPNs, SaaS, and legacy services, then replace them with stronger MFA or passwordless options where feasible. Treat any exception as an explicit risk decision.
• Reduce credential reuse and sharing pressure Review workflows where employees share passwords or hand over access to get work done, then redesign those processes so the user does not need to disclose credentials to complete the task.
• Extend identity controls to personal devices that touch work Define which mobile and home devices can access work email, chat, or SaaS apps, and enforce authentication methods that limit the damage if those endpoints are compromised.
• Measure adoption friction as a security signal Track where users bypass, resist, or delay authentication changes, because repeated friction often predicts shadow workarounds and weaker real-world protection than policy suggests.

Key takeaways

• Phishing-resistant MFA is a response to a basic identity weakness: credentials that users can be tricked into giving away remain easy to exploit.
• The article ties phishing to broad operational damage, including account compromise, reputation loss, and revenue impact.
• IAM teams should treat authentication hardening as a programme decision, not a point control, and remove password-only paths where possible.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Authentication Friction: The delay, confusion, and support burden created when users cannot complete sign-in cleanly. In IAM programmes, friction is a governance signal because it drives resets, exceptions, and workarounds. If users routinely hit the recovery path, the authentication design is not yet operationally stable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.