Phishing-resistant passwordless authentication is becoming the baseline

At a glance

What this is: NHI Mgmt Group's analysis, drawing on RSA Security's blog post: Phishing-resistant passwordless authentication is becoming the practical baseline because passwords and OTP-based MFA remain vulnerable to interception, replay, and fake login portals.

Why it matters: It matters because IAM teams need controls that resist phishing at the authenticator layer, not just stronger user messaging or more MFA prompts.

By the numbers:

• 87% of companies are either deploying or plan to deploy passkeys to enhance security and user experience, according to RSA Security.

Context

Passwordless authentication is an access control model that removes shared secrets from the login process and binds authentication to a device, origin, or cryptographic credential. In this article, RSA Security argues that phishing resistance is no longer a niche aspiration but a baseline requirement because credential theft techniques continue to defeat traditional passwords and OTP-based MFA.

The governance issue for IAM teams is not whether authentication is convenient enough, but whether the control can still resist credential interception, fake login portals, and replay when attackers target the login step itself. That makes phishing-resistant methods relevant across workforce and customer identity programmes, not only in regulated sectors.

The article also connects the shift to passwordless with phased adoption, which matters because most organisations are not replacing all authentication at once. The practical question is how to move from password plus MFA patterns toward device-bound authentication without leaving mixed-control gaps during the transition.

Key questions

Q: What breaks when organisations rely on OTP codes as the main defence against phishing?

A: OTP alone breaks when attackers can proxy the legitimate login session and harvest the code as the user enters it. In that case, the code proves the user saw a prompt, but it does not prove the request was initiated on the real site. Organisations then lose the assurance they expect from step-up authentication and remain exposed to unauthorized account access and transactions.

Q: Why do phishing-resistant methods reduce account takeover risk?

A: They reduce account takeover risk because the attacker cannot easily steal a reusable secret and use it somewhere else. Device-bound authentication and origin validation stop the captured credential from behaving like a portable token. In practice, that changes the compromise path from easy replay to much harder device or session compromise.

Q: How should IAM teams implement passwordless authentication without breaking customer journeys?

A: Start with hybrid deployment in new or low-risk flows, then expand to existing journeys once recovery, fallback, and step-up rules are proven. The goal is not to remove passwords overnight but to reduce their role while preserving login success, support stability, and user trust.

Q: Should organisations treat passkeys, hardware keys, and biometrics the same way?

A: No. They can all support phishing-resistant authentication, but they do not provide the same operational profile. IAM teams should compare how each method binds to the device, how it handles fallback, and whether it remains resistant when users are away from managed endpoints. The right choice depends on the access journey, not the label.

Technical breakdown

Why passwordless authentication breaks the shared-secret model

Traditional passwords and OTP-based MFA both rely on secrets that can be copied, intercepted, or replayed. Passwordless authentication changes the trust model by using cryptographic proof bound to a device or origin, so the authenticator no longer sends a reusable secret over the network. That makes phishing kits, man-in-the-middle portals, and keyloggers far less effective because the attacker cannot simply reuse what the user entered. In identity terms, the control shifts from knowledge-based proof to possession of a bound credential plus origin validation.

Practical implication: Treat passwordless as an authenticator redesign, not a user-experience upgrade.

Why OTP-based MFA still fails under phishing pressure

OTP-based MFA adds a second factor, but it does not automatically make authentication phishing-resistant. If an attacker can trick a user into entering a one-time code into a fake login page, or capture it through interception, the code still becomes a live credential. The article’s point is that MFA is not a binary category. Resistance depends on whether the method is cryptographically bound to the device and origin, and whether the secret can be replayed outside the legitimate session.

Practical implication: Do not classify every MFA method as phishing-resistant just because it has more than one step.

How device binding and origin binding change IAM assurance

Device binding ties the authenticator to a specific device, while origin binding ensures the credential only works for the legitimate site or relying party. Together, they remove the attacker’s ability to reuse captured credentials in a different context. That is why passkeys, hardware keys, smart cards, and some biometric flows behave differently from OTPs: the proof is created and validated inside a constrained trust relationship rather than transmitted as a portable secret. For IAM programmes, that changes assurance from identity challenge to cryptographic verification.

Practical implication: Prioritise authentication methods that bind the credential to the device and the login origin.

Threat narrative

Attacker objective: The attacker’s objective is account takeover using credentials or one-time codes that can be reused against the legitimate service.

1. Attackers begin with phishing that impersonates a legitimate login page or service and persuades the user to authenticate.
2. The credential or OTP is captured, intercepted, or replayed because the method is not cryptographically bound to the device or origin.
3. The stolen authentication material is used to access the real account and bypass traditional MFA protections.
4. The attacker gains account takeover, often with the ability to move into email, cloud apps, or other connected services.

Breaches seen in the wild

• Change Healthcare breach 2024: A stolen login on a Citrix portal without MFA led to ALPHV ransomware, a $22 million ransom and 192.7 million people affected.
• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing resistance is now an authenticator baseline, not a premium feature. Passwords and OTP-based MFA still leave the organisation exposed to replay, interception, and fake portal attacks. That means IAM programmes should stop treating passwordless as an optional enhancement and start treating phishing resistance as the minimum acceptable authentication property for high-value access.

The real shift is from reusable secrets to device-bound proof. Shared secrets create an attack surface that phishing kits can harvest and replay at scale. Once the authenticator is tied to the device and origin, the attacker loses the portable credential that made the compromise easy, which is why this change matters across workforce and customer identity.

Passwordless adoption exposes the weakness of mixed-control estates. Most organisations will operate hybrid authentication states for some time, and the risk sits in the overlap between phishing-resistant and legacy methods. That overlap becomes a governance problem, not just a rollout problem, because policy needs to distinguish between methods that merely add a factor and methods that actually resist phishing.

Phishing-resistant MFA should be evaluated as an assurance model, not a product category. Passkeys, hardware keys, smart cards, and some biometric implementations can all serve the same governance goal when they validate device and origin and avoid shared secrets. Practitioners should compare methods on binding strength, deployment friction, and the remaining fallback paths, because fallback paths are where compromise often re-enters.

Credential theft remains the control failure that unites human and machine identity risk. The same weakness that undermines user login also undermines service and administrative access when a reusable secret can be stolen and replayed. IAM teams that normalise phishing-resistant authentication for humans are also building the governance muscle needed to protect other identity types from the same trust failure.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
• Read next: Ultimate Guide to NHIs — Static vs Dynamic Secrets

What this signals

Passwordless adoption changes the control boundary for IAM teams. The key decision is no longer how many factors a user presents, but whether the method prevents replay and origin spoofing. That moves authentication governance from secret handling to cryptographic assurance, which is a very different operating model for privileged and customer access alike.

Mixed estates are where most risk will sit during migration. Organisations will keep legacy MFA alive while they introduce passkeys and other phishing-resistant options, so the weakest fallback path becomes the real control boundary. IAM leaders should therefore govern the transition as a security programme, not a convenience rollout.

For practitioners

• Inventory every password and OTP dependency Map where passwords, SMS codes, email OTPs, authenticator-app OTPs, and legacy fallback methods are still used across workforce and customer access. Use that inventory to identify the highest-risk journeys first, especially administrative access, privileged support paths, and externally exposed sign-in flows.
• Prioritise device-bound methods for high-value access Move privileged, regulated, and customer-facing access toward passkeys, hardware keys, smart cards, or other methods that bind authentication to the device or origin. Reserve weaker fallback methods only where a phased migration genuinely requires them, and document the residual risk explicitly.
• Separate phishing-resistant from multi-factor in policy Write policy so teams do not describe every MFA method as phishing-resistant. Require the security architecture to show how the chosen method prevents credential replay, not just how many steps the login contains.
• Design migration phases around real use cases Start with the applications and user groups that face the highest phishing exposure, then sequence rollout by feasible method, platform support, and fallback dependency. Keep the transition visible to IAM, help desk, and application owners so control gaps do not hide in exceptions.

Key takeaways

• Phishing-resistant authentication reduces risk by removing reusable secrets from the login flow and binding proof to the device or origin.
• OTP-based MFA can still be intercepted or replayed, so more factors do not automatically mean better phishing resistance.
• IAM teams should phase in passwordless methods by prioritising high-value use cases and managing the mixed-control period explicitly.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Device binding: A control that links an authenticator or key pair to a specific endpoint so the same secret cannot be copied and reused elsewhere. It strengthens assurance, but the binding step itself becomes a high-value target if attackers can intercept the enrollment process.
• Origin binding: A cryptographic property that ties an authentication response to the legitimate site or service being accessed. It reduces the value of fake login pages because a credential response generated for one origin cannot be reused on another without failing verification.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.