Topic starter
21/08/2026 4:45 pm
TL;DR: Hybrid work, transparency demands, crowdsourced security, AI-powered abuse, and adversary targeting of MFA and EDR will remain central in 2023, according to INTIGRITI’s year-ahead cybersecurity trends. The practical issue is not new tooling alone, but whether identity, endpoint, and incident response controls can keep pace with faster attacker adaptation and broader attack surfaces.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “Top cybersecurity trends for 2023”.
Key questions
Q: What should organisations do when users work around MFA or other access controls?
A: Treat workarounds as evidence that the control design is not aligned with user behaviour.
Q: Why do AI-driven attacks make trust controls harder to maintain?
A: AI-driven attacks are harder to maintain against because they adapt faster than static controls and can be personalised at scale.
Q: What breaks when endpoint detection is evaded?
A: When EDR is bypassed, defenders lose visibility into process activity, lateral movement, and post-compromise behaviour on the device.
Practitioner guidance
- Prioritise phishing-resistant MFA for high-risk access Use hardware-backed or passkey-based authentication for privileged users, remote access, and high-value systems where session compromise would be costly.
- Tie access decisions to device trust signals Require device health, management state, and endpoint compliance as inputs to access policy so compromised or unmanaged devices do not receive the same trust as corporate-managed endpoints.
- Review MFA bypass paths and session abuse risks Test for push fatigue, token theft, relay attacks, and session hijacking in the authentication flow, then close the paths that remain after login.
Bottom line: Hybrid work, AI-enabled abuse, and endpoint evasion are forcing security teams to treat identity, device, and detection as one connected control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:05 pm
MFA is not a governance endpoint, only a control point. The article shows that authentication strength only matters when the factor itself is resistant to phishing and session abuse. Once organisations treat MFA as a checkbox, they leave a policy-shaped gap that attackers can still route through. The practitioner conclusion is that assurance must move from generic MFA adoption to phishing-resistant authentication for the workflows that matter most.
A question worth separating out:
Q: Should remote work security prioritise user authentication or device assurance first?
A: They should be treated together, but device assurance becomes critical once access leaves the office perimeter. A strong login proves little if the endpoint is unmanaged, unhealthy, or already compromised, so policy should combine authentication strength with device posture before granting access.
👉 Read our full editorial: Why existing cybersecurity controls are falling short for AI and MFA