Why passwordless, phishing-resistant MFA is now the baseline

At a glance

What this is: This is an argument that password-based access and basic MFA are no longer sufficient, with breach examples showing why phishing-resistant authentication has become the baseline.

Why it matters: It matters because IAM teams need to distinguish between MFA that can still be bypassed and authentication that actually resists phishing, token theft and credential reuse.

By the numbers:

• In 2023, data breaches were up by 20% over 2022, according to a study from Apple cited by Axiad.
• IBM said the average cost of a data breach was $4.5 million in 2023, the highest average on record, according to Axiad.

Context

Passwordless authentication removes the shared secret that attackers routinely target through phishing, smishing, vishing and credential stuffing. In this article, Axiad frames the problem as an authentication baseline that has not kept pace with current attack chains.

For IAM teams, the issue is not whether MFA exists, but whether the factor can be phished, replayed or stolen. The article’s breach examples show that basic MFA and password reuse still leave a wide enough gap for session hijack and account takeover.

That makes phishing-resistant authentication a governance question as much as a technical one: organisations need to decide which authenticators are genuinely resistant, which are only perceived to be safer, and where legacy methods still create avoidable exposure.

Key questions

Q: What should security teams do first when they still rely on password-only authentication for some resources?

A: The first move is to identify the most sensitive applications and administrative accounts, then require MFA there before expanding broadly. Password-only access leaves organisations exposed because stolen credentials remain enough for entry. Teams should pair rollout with user-friendly enrollment, clear policy enforcement, and a plan to replace telephony-based methods with stronger options.

Q: Why do OTP based MFA flows still fail against modern phishing and adversary in the middle attacks?

A: OTP based MFA fails because it assumes the user who receives a code is the legitimate user. Attackers can intercept, relay, and replay those codes in real time, especially through phishing and adversary in the middle techniques. Once the code is forwarded before expiry, the control provides little real assurance, even though it appears strong on paper.

Q: How do you know if phishing-resistant MFA is actually working?

A: Look for enrolment coverage by user group, renewal discipline, exception rates, and the absence of weak fallback methods. A working programme does not just issue stronger authenticators. It can prove who is enrolled, which credentials are current, and where the rollout still depends on exceptions or untracked recovery paths.

Q: What is the difference between stronger MFA and phishing-resistant authentication?

A: Stronger MFA usually means adding more factors, but phishing-resistant authentication changes the architecture so the factor cannot be easily replayed or proxied. FIDO2 is the clearest example because it binds authentication to the origin and keeps the private key on the device, which reduces interception risk.

Technical breakdown

Why passwords and basic MFA fail against modern phishing

Passwords are reusable secrets, so they can be harvested once and replayed many times. Basic MFA often improves the login flow but does not necessarily remove the attacker’s ability to capture or reuse an authentication factor. SMS, voice, OTP codes and push approvals still rely on a user interaction that can be intercepted, socially engineered or proxied. In practice, that means the attacker does not need to defeat identity controls in a conventional sense. They only need a credential path that can be copied, replayed or coerced into approval.

Practical implication: Treat any factor that can be replayed or socially engineered as insufficient for high-risk access.

What makes phishing-resistant authentication different

Phishing-resistant authentication binds the credential to the legitimate origin and makes replay from a fake site or attacker-controlled channel ineffective. In the article, Axiad identifies certificate-based authentication backed by PKI and FIDO-compliant authenticators as the two methods it considers truly phishing resistant. The key distinction is that the authenticator is not simply a second step after the password. It is designed so the credential cannot be used outside the intended trust context, which sharply reduces phishing and token theft success rates.

Practical implication: Prioritise authenticators that cryptographically bind the login to the real service or device context.

Why session tokens and reused credentials remain the real prize

Many account takeovers do not end at the login screen. Once attackers obtain valid credentials or session tokens, they can bypass password checks entirely and move as an authenticated user. That is why credential stuffing, stolen credential reuse and support-system compromise remain so effective. The article’s Okta example shows the downstream risk clearly: credential theft can become session-token theft, and session-token theft can become downstream access across many customer environments. Authentication controls must therefore be judged by what they protect after first entry, not only at the password prompt.

Practical implication: Add token and session exposure to your authentication risk review, not just password policy.

Threat narrative

Attacker objective: The attacker wants authenticated access that bypasses user awareness and can be replayed into customer data, session tokens or downstream systems.

1. Entry occurs through phishing, smishing, vishing or credential stuffing, where attackers obtain valid usernames, passwords or other reusable login material.
2. Credential access follows when the attacker reuses those secrets or captures session tokens from a support or authentication workflow.
3. Escalation happens when the stolen session or reused credential is accepted as legitimate access inside the target environment.
4. Impact is account takeover, customer data exposure and downstream access into other connected systems or tenant environments.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Password-based authentication is now a liability surface, not an assurance layer: Once credentials can be phished, stuffed, reused or replayed, the authentication step stops proving user legitimacy. That is especially true when the same credential can unlock multiple services or tenant-adjacent workflows. The implication is that identity programmes should stop treating passwords as a default control for meaningful access decisions.

Phishing resistance is the relevant control boundary, not MFA branding: The market still uses MFA as if every second factor behaves the same way, but the article shows that SMS, voice, OTP and push approval can still be coerced or intercepted. What matters is whether the factor is cryptographically bound to the real relying party and resistant to phishing. Practitioners should judge controls by their attack resistance, not their label.

Session theft changes the authentication problem after the first login: A stolen credential is bad, but a stolen session token can be worse because it moves the attacker past the login challenge entirely. That shifts governance from initial authentication to end-to-end session assurance, especially where support tooling or identity workflows can expose high-value tokens. Identity teams need to treat post-authentication artefacts as first-class assets.

Certificate-based authentication and FIDO define the practical baseline for high-risk access: The article’s core point is not that every user must adopt the same control, but that some access paths now require stronger proof than knowledge or possession factors can provide. For internet-facing, privileged or sensitive workflows, phishing-resistant methods are no longer optional hardening. They are the minimum control line that matches current threat economics.

Reusable secrets create preventable identity attack surface: Passwords, OTPs and shared secrets all preserve the attacker’s ability to transfer trust from one context to another. That is the underlying governance failure exposed here. Organisations should stop designing access around secrets that can be copied and start designing around authenticators that cannot be replayed across contexts.

From our research library:

• Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.

What this signals

Phishing-resistant authentication is now an access design decision, not a user-training problem: When a login method can be replayed or coerced, awareness campaigns do not remove the technical exposure. IAM teams should reclassify authenticator choice as a control design issue and reserve weaker factors for low-risk scenarios only.

Session protection has become part of identity assurance: The article’s breach examples show that attackers increasingly target the artefacts created after successful authentication. That means recovery flows, token handling and support processes need the same scrutiny as login policy, because a valid session can bypass the password debate entirely.

For practitioners

• Prioritise phishing-resistant authenticators for high-risk access Move privileged users, admins and support workflows to authenticators that cannot be replayed from a fake site, especially where account takeover would expose customer data or tenant-level access.
• Retire SMS, voice and OTP as trusted second factors Classify these methods as transitional, not durable, controls for sensitive access because they can still be intercepted, proxied or socially engineered.
• Harden recovery and support workflows Treat help-desk and account recovery paths as part of the authentication surface, since stolen credentials often become session tokens through those workflows.
• Review session-token exposure paths Map where tokens are issued, displayed, exported or cached so you can reduce the chance that a valid session becomes the attacker’s easiest path past MFA.

Key takeaways

• Passwords, SMS codes and generic MFA are no longer enough to stop contemporary phishing and credential replay attacks.
• The strongest examples in the article show that attackers often win by reusing trusted credentials or stealing session artefacts, not by breaking cryptography.
• Phishing-resistant authentication should be the default for privileged and sensitive access, with recovery and support paths governed as part of the same control surface.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Session Token Exposure: Session token exposure occurs when authentication tokens or session artifacts are stored, transmitted, or logged in places they should not be. Once exposed, they can function like reusable credentials. This makes them part of identity and access risk, not only application behaviour.
• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.