Phishing-resistant MFA remains a gap in fragmented IAM estates

At a glance

What this is: This article argues that phishing-resistant MFA matters most where IAM estates are fragmented, because legacy and siloed authentication paths can leave users exposed even when MFA exists.

Why it matters: For IAM, IGA, and PAM teams, the lesson is that coverage, consistency, and resistance to interception matter more than simply saying MFA is deployed.

By the numbers:

• 84% said their organization had experienced an identity-related breach in the past year.
• phishing attacks were the most common breach type at 59%, whether broad-based attacks or spear phishing.
• 70% of organizations use 3 or more IAM systems across their organization.

Context

Phishing-resistant MFA is not just a stronger login option. It is a governance response to a simple but persistent problem: many organisations still authenticate users through a patchwork of IAM systems, legacy MFA methods, and inconsistent policy coverage.

In that kind of estate, phishing risk is not confined to one control point. The issue is that a control can be present in one system and absent in another, creating gaps that attackers can exploit through interception, replay, or social engineering.

The article focuses on human IAM, but the governance lesson also matters to identity programmes that span service accounts and autonomous systems: when access paths multiply, assurance has to be consistent across the full estate, not only in the newest deployment.

Key questions

Q: What breaks when phishing-resistant MFA is not in place for regulated systems?

A: When phishing-resistant MFA is missing, a single phishing message can expose authenticated access paths that regulators expect to be stronger. In NYDFS environments, that weak link can convert an email compromise into a compliance failure because the control is meant to reduce credential replay and prove access assurance on sensitive systems.

Q: Why do fragmented IAM estates increase phishing risk?

A: Fragmentation creates different authentication rules across systems, so one application may enforce stronger MFA while another still accepts weaker methods. Attackers do not need to defeat the strongest control everywhere, only find the weakest reachable path. In practice, the estate becomes as secure as its least governed login flow, especially when users move between cloud, legacy, and remote access environments.

Q: How do you know if phishing-resistant MFA is actually working?

A: Look for enrolment coverage by user group, renewal discipline, exception rates, and the absence of weak fallback methods. A working programme does not just issue stronger authenticators. It can prove who is enrolled, which credentials are current, and where the rollout still depends on exceptions or untracked recovery paths.

Q: Should organisations replace legacy MFA before unifying IAM systems?

A: Yes, for the highest-risk users and access paths. A fragmented estate can preserve weak methods even after a modern IAM rollout, so removing the most abusable factors first reduces immediate exposure. Organisations should prioritise the sign-in paths that reach administrative, remote, or sensitive business systems, then standardise the stronger method across the rest of the estate.

Technical breakdown

Why legacy MFA fails against phishing

Phishing-resistant MFA is designed to prevent an attacker from using stolen credentials or intercepted verification data to complete authentication. Legacy MFA, especially SMS-based or man-in-the-middle-prone methods, can still be bypassed when the attacker can relay prompts, intercept codes, or trick the user into authenticating through a fake login flow. The technical distinction is not simply “more factors” but whether the factor is bound to the real origin, device, or cryptographic credential. In practice, phishing resistance depends on the authentication method breaking the attacker’s ability to replay the session from a separate endpoint.

Practical implication: Treat SMS and other relayable factors as insufficient for high-risk access paths.

How fragmented IAM estates create inconsistent MFA coverage

When an organisation runs multiple IAM systems, authentication policy often diverges by platform, business unit, or legacy constraint. That fragmentation creates different assurance levels for different users and access paths, which is exactly what phishing campaigns exploit. A user may face phishing-resistant MFA in one environment and a weaker method in another, even when both systems belong to the same enterprise. The technical problem is policy sprawl: the authentication stack becomes a set of semi-independent trust zones rather than one governed identity plane. That is why coverage alone is not the same as control consistency.

Practical implication: Map every authentication path and remove any weaker method left in a parallel IAM stack.

Where certificate-based authentication changes the control model

Certificate-based authentication uses a cryptographic credential rather than a transferable code to prove identity, which materially reduces the usefulness of phishing, SIM swapping, and simple credential replay. It also aligns better with passwordless access because the authentication event is bound to a device or token with stronger proof of possession. In a fragmented IAM environment, the architectural value is overlay: a common phishing-resistant method can sit across multiple systems and operating environments. That makes the control easier to standardise, but only if certificate lifecycle management is also governed well.

Practical implication: Pair phishing-resistant authentication with certificate lifecycle governance, or the control will drift over time.

Threat narrative

Attacker objective: The attacker wants to convert one successful phishing interaction into broader account access across fragmented identity infrastructure.

1. Entry begins with phishing or credential collection through a fake login page, SMS interception, or another user-deception route.
2. Credential abuse follows when the attacker relays the captured secret or bypasses weak MFA to complete authentication.
3. Escalation occurs when the compromised session reaches a more privileged application or identity path that still accepts the weaker control.
4. Impact is achieved through account takeover, data access, or downstream movement across other IAM systems with inconsistent enforcement.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant MFA is now a governance consistency problem, not just an authentication choice. The article shows that organisations can have MFA in place and still remain exposed when the methods differ across IAM systems. That means the real control question is whether every authentication path is resistant to interception and replay, not whether MFA exists somewhere in the stack.

Identity fragmentation creates phishing exposure windows that policy teams routinely underestimate. When 70% of organisations run 3 or more IAM systems, the estate itself becomes part of the risk. The more trust boundaries an enterprise maintains, the more likely a weaker authentication path will survive in production and be reachable by attackers.

Certificate-based authentication is best understood as a standardisation layer for human identity assurance. Its value is not only stronger phishing resistance, but the ability to overlay multiple environments with one consistent control pattern. For practitioners, that shifts the discussion from local MFA preference to enterprise-wide authentication governance.

Phishing resistance should be measured at the path level, not the product level. A control that is strong in one application but weak in another does not meaningfully reduce enterprise risk. The programme implication is to govern authentication paths as a portfolio of trust decisions, not as a set of isolated implementations.

Phishing-resistant MFA increasingly overlaps with broader identity resilience, including credential lifecycle and user self-service. The article’s operational point is that authentication controls are easier to sustain when credential provisioning, reset, and lifecycle steps are also controlled. Practitioners should treat authentication hardening and identity operations as one programme rather than separate workstreams.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Phishing resistance has become an estate-level control problem. Teams that treat MFA as an application feature will keep missing the weakest path in multi-IAM environments. The governance task is to standardise authentication assurance across every login route, including legacy systems that still sit outside the main identity programme.

Authentication hardening now depends on consistency more than feature count. A control stack with one phishing-resistant path and several weaker ones remains vulnerable because attackers only need one place where relay or interception still works. That is why mapping and eliminating authentication variance is more important than checking whether MFA exists.

Certificate-based authentication changes the programme conversation from factor selection to lifecycle discipline. Once a stronger factor is in place, the operational question becomes whether issuance, recovery, and revocation are governed well enough to keep it trustworthy over time.

For practitioners

• Map authentication paths across every IAM system Inventory which login flows still rely on SMS, push approval, or other relayable factors, then rank them by exposure and user privilege.
• Eliminate weaker MFA methods on high-risk access paths Remove SMS and other replayable methods from admin, remote access, and sensitive application sign-in flows before attackers exploit the weakest route.
• Standardise phishing-resistant authentication across the estate Use one governed control pattern for all major IAM systems so security policy does not vary by platform, business unit, or operating system.
• Govern certificate lifecycle alongside authentication Track issuance, renewal, revocation, and recovery for certificate-based authentication so the stronger factor does not become another unmanaged credential.
• Test for man-in-the-middle exposure in real sign-in flows Validate whether lookalike login pages, proxy attacks, or interception steps can still complete authentication against production systems.

Key takeaways

• Phishing-resistant MFA addresses replay and interception risk, but fragmented IAM estates can still leave weaker login paths open.
• The article points to a control gap between having MFA and enforcing the same level of resistance everywhere users authenticate.
• For practitioners, the immediate priority is to inventory authentication paths, remove relayable methods, and govern certificate lifecycles if CBA is used.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Certificate-based authentication: A method of proving identity using a cryptographic certificate and the associated private key rather than a reusable password. In identity programmes, it raises the bar for theft and replay because the secret is bound to lifecycle, issuance, and revocation control.
• IAM Estate Fragmentation: IAM estate fragmentation is the condition where an organisation runs multiple identity systems, each with its own policies, integrations, or legacy exceptions. The result is uneven authentication strength, inconsistent MFA enforcement, and a higher chance that one weak path remains exploitable.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.