TL;DR: The DoW CIO’s new “Brilliant at the Basics” guidance ranks phishing-resistant MFA as the top IT cybersecurity practice for small, mid-sized, and non-traditional Defense Industrial Base suppliers, signalling that SMS codes and push-based MFA no longer meet the modern trust bar, according to Yubico. Legacy MFA assumes attackers cannot intercept or socially engineer the second factor, but that assumption breaks under phishing, SIM-swapping, and MFA fatigue.
At a glance
What this is: This is a commentary on the DoW CIO’s DIB guidance, which places phishing-resistant MFA ahead of other baseline IT practices and treats legacy MFA as insufficient against modern credential attacks.
Why it matters: It matters because defense suppliers cannot treat MFA as a checkbox if their access model still depends on factors that can be phished, intercepted, or socially engineered.
Context
The security gap here is not authentication in the abstract. It is the assumption that any second factor is equally resistant to modern adversary techniques, when SMS and push approvals can still be intercepted, relayed, or manipulated.
For the Defense Industrial Base, that distinction matters because access to government-linked systems and data depends on how credentials are issued, approved, and verified. The DoW CIO’s ranking turns phishing-resistant MFA into an access governance issue, not just a login preference.
The article’s core message is that baseline identity controls must match the attack environment. If the second factor can be socially engineered, the control may satisfy a policy screen while leaving the session boundary exposed.
Key questions
Q: What breaks when organisations rely on SMS or email MFA for sensitive access?
A: The control breaks when the second factor can be intercepted, relayed, or socially engineered. SMS, email, and OTP-based MFA improve security over passwords, but they still leave room for SIM swapping and man-in-the-middle phishing. For sensitive access, that means the organisation is still authenticating through a phishable channel rather than using a proof method that resists interception.
Q: When does phishing-resistant MFA create more value than traditional MFA?
A: It creates the most value where credential theft, phishing, and session hijacking are recurring threats, especially for customer login, employee access, and privileged activity. Traditional MFA still relies on factors that can be intercepted or replayed, while phishing-resistant methods bind authentication to the device and reduce replay risk.
Q: How should DIB suppliers decide whether MFA is strong enough?
A: They should ask whether the factor can be replayed, intercepted, or socially engineered outside the legitimate session. If it can, it is not strong enough for high-trust environments. The test is not whether MFA exists, but whether it meaningfully resists the attack methods used against defense suppliers.
Q: Should organisations prioritise phishing-resistant MFA over other identity projects?
A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.
Technical breakdown
Why legacy MFA fails under phishing and interception
Legacy MFA typically relies on codes or approvals that are separable from the original login request. SMS codes can be redirected, push prompts can be fatigue-abused, and both can be relayed through phishing infrastructure or intercepted through SIM-swapping. The security weakness is not simply that attackers are clever. It is that the factor itself is not cryptographically bound to the authentication ceremony. Phishing-resistant methods, by contrast, bind the credential to the device and origin so the proof cannot be replayed in a fake session.
Practical implication: Treat SMS and push-based MFA as legacy controls for high-trust environments and remove them from privileged and supplier access paths.
How phishing-resistant authentication changes the trust boundary
Phishing-resistant MFA shifts trust from user recognition to cryptographic proof. FIDO2 and WebAuthn credentials, including hardware-backed passkeys and PIV/CAC, keep private keys on the authenticator and verify the originating site before releasing a response. That means the attacker cannot simply ask the user for a code and reuse it elsewhere. In practice, this changes the control from a recoverable secret to a device-bound assertion. For DIB suppliers, that matters because the login event becomes resistant to the same social engineering techniques that undermine conventional MFA.
Practical implication: Use device-bound authenticators where access to sensitive government or contractor systems depends on strong identity proofing.
Why IT and OT guidance now converge on identity control
The article notes that the OT list also starts with identity and access control, which shows the convergence between enterprise login protection and operational resilience. OT systems are often harder to patch and more dangerous to interrupt, so the identity layer becomes a front-line control for preventing unsafe access. That convergence matters because many DIB organisations run both IT and OT under the same supplier umbrella, yet the attack consequences differ. Identity governance must therefore account for both environments without assuming a single corporate access model is enough.
Practical implication: Separate IT and OT identity controls so operational systems are not left protected by enterprise authentication choices alone.
Threat narrative
Attacker objective: The objective is to bypass login assurance and gain trusted access to defense supplier environments.
- Entry begins when an attacker phishes a user or manipulates an MFA workflow that still relies on SMS codes or push approvals.
- Credential access succeeds when the attacker captures, relays, or coaxes the second factor into authorising a session.
- Impact follows when the attacker enters a DIB environment that was relying on legacy MFA as a trust boundary and reaches sensitive systems or data.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing-resistant MFA is now an access governance baseline, not an advanced option: Once a government customer names it the top practice, the decision space changes for every supplier that still treats SMS or push approvals as acceptable. The issue is not whether MFA exists, but whether the factor can survive phishing, interception, and approval abuse. Practitioners should read this as a control-class shift, not a product feature debate.
The trust assumption that breaks is simple: a second factor is only useful if the attacker cannot reuse it elsewhere: Legacy MFA was designed for a threat model where the second step remained anchored to the real session. That assumption fails when the attacker can proxy the login, trigger approval fatigue, or intercept the code path. The implication is that authentication assurance must be tied to the origin and device, not just to user participation.
Defense suppliers now face a dual-stack identity problem across IT and OT: The article shows that the same policy direction is appearing in both environments, but the operational stakes are different. OT environments often resist rapid change, yet identity failures there can create physical and continuity impact as well as data exposure. Practitioners should align identity controls across both domains without collapsing them into one access model.
Legacy MFA exposure window: The DIB guidance makes clear that a login control is only as strong as the attack path that can still reach it. When authentication depends on a factor that can be phished, intercepted, or fatigued, the exposure window remains open even if the policy says MFA is in place. The practical conclusion is that assurance now matters more than coverage.
Supplier access must be judged by the quality of the second factor, not by MFA presence alone: In defense supply chains, weak MFA can become a hidden trust compromise across vendors, subcontractors, and managed service paths. That makes authentication assurance a shared ecosystem problem, not just an internal IT task. Practitioners should treat phishing-resistant MFA as the minimum defensible supplier access standard.
From our research library:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
- Read next: MFA Guide
What this signals
Phishing-resistant MFA is becoming the new baseline for supplier access: DIB guidance is pushing identity teams to treat factor quality as a governance decision, not a user convenience trade-off. That will influence procurement standards, access reviews, and assurance language across the defense supply chain.
Access assurance now sits upstream of most other security controls: If login proof is weak, patching, backup, and network segmentation all inherit a compromised trust boundary. Practitioners should expect stronger scrutiny of authenticator choice in both enterprise and operational environments.
Legacy MFA no longer carries the same trust weight in high-value environments: Security teams should map where code-based or push-based approval still protects privileged access and replace those paths before they become the weakest point in supplier assurance.
For practitioners
- Replace legacy MFA on sensitive access paths Remove SMS and push-based approval methods from privileged, supplier, and government-facing accounts where phishing resistance is required.
- Adopt device-bound authenticators for high-trust access Use FIDO2/WebAuthn security keys or PIV/CAC credentials for systems that rely on stronger proof of user presence and origin binding.
- Separate IT and OT identity controls Do not assume the corporate authentication stack is sufficient for operational technology, where access paths and consequences differ.
- Reclassify phishing-resistant MFA as a baseline requirement Update supplier access standards so procurement, assurance, and security teams evaluate whether authentication methods resist modern phishing techniques.
Key takeaways
- Phishing-resistant MFA is being treated as the minimum defensible access control for DIB suppliers, which shifts the conversation from MFA coverage to MFA quality.
- Legacy MFA can still be defeated through phishing, SIM-swapping, push fatigue, and relay attacks, so a second factor does not automatically equal stronger assurance.
- The practical response is to remove weak MFA from sensitive paths, adopt device-bound authenticators, and align identity controls across both IT and OT.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article is about authentication methods that can still be phished or intercepted. |
| NHI-10 — Human Use of NHI | The article warns against user-interpretable factors that attackers can socially engineer. | |
| Recommendation — Replace replayable MFA methods with phishing-resistant authentication on sensitive access paths. Reduce reliance on human-action approvals that attackers can manipulate during login. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | DIB supplier access to sensitive systems depends on stronger user authentication assurance. |
| Recommendation — Apply IA-2 to require phishing-resistant authentication for organizational users. | ||
| NIST Zero Trust (SP 800-207) | 6.1 — Identity and Authentication | The guidance reinforces strong identity proofing and authentication at the access boundary. |
| Recommendation — Anchor zero-trust access decisions to phishing-resistant identity verification. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on how accounts are authenticated and protected from takeover. |
| Recommendation — Review account authentication methods and retire weak MFA for high-risk users. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The threat pattern is phishing and MFA abuse leading to credentialed access. |
| Recommendation — Map phishing-resistant MFA to TA0006 and harden the login path against credential theft. | ||
Key terms
- Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
- Hardware-Backed Passkey: A hardware-backed passkey is a phishing-resistant authenticator stored on a secure device and used to prove possession during login. It reduces replay and credential theft risk because the private key is not copied into a reusable shared secret.
- Push fatigue: A condition where repeated mobile approval prompts train users to approve authentication requests without careful review. Attackers exploit the fatigue to turn a human decision into an accidental bypass, especially after they already know the password.
- Defense Industrial Base: The Defense Industrial Base is the ecosystem of organisations that build, supply, support, and maintain products and services for defense missions. It includes primes and subcontractors, which means security obligations extend beyond the largest contractors to the smaller suppliers that can still hold sensitive information or access.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 26, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org