Notifications
Clear all
Topic starter
12/06/2026 9:13 pm
TL;DR: FIDO Alliance seminar takeaways reinforce that phishing proxies, adversary-in-the-middle attacks, and social engineering are eroding the value of traditional MFA, while passkeys and hardware-backed FIDO credentials reduce interception risk, according to OneSpan’s recap of the event. Authentication programmes now need to treat phishing-resistant methods as the default, not an enhancement, because the old trust model is breaking under modern attack pressure.
NHIMG editorial — based on content published by OneSpan: Back to identity: FIDO Alliance and the future of phishing-resistant authentication
By the numbers:
- Phishing attacks increased by 4.2% after the introduction of ChatGPT.
- Over 53% of consumers reported an increase in suspicious digital activity over the past year.
Questions worth separating out
Q: How should security teams roll out passkeys without disrupting existing identity programmes?
A: Start with the highest-risk populations first, especially administrators, help-desk teams, and users who face frequent phishing attempts.
Q: Why do phishing-resistant authenticators matter more than legacy MFA?
A: Legacy MFA often adds a second step without changing the trust model, so attackers can still relay or intercept the login flow.
Q: What do IAM teams get wrong about authentication and AI risk?
A: Many teams treat AI as a separate topic from identity, when in practice AI increases both impersonation risk and the need for stronger authorization.
Practitioner guidance
- Prioritise phishing-resistant authentication for high-risk accounts Move administrators, support staff, and privileged business users to passkeys or hardware-backed authenticators before broad population rollout.
- Remove reliance on interceptable second factors Review where OTPs, push approvals, and other replayable factors still serve as primary protections.
- Test authentication against relay and impersonation attacks Run tabletop and red-team exercises that simulate phishing proxies, real-time credential relay, and deepfake-assisted support calls.
What's in the full article
OneSpan's full blog covers the operational detail this post intentionally leaves for the source:
- The seminar-specific framing behind the FIDO Alliance discussion and how the speakers connected authentication, usability, and AI.
- Examples of how passkeys are being positioned across workforce access, customer sign-in, and ecosystem integrations.
- The article’s own explanation of why hardware security keys are still preferred for higher-assurance use cases.
- The author’s closing perspective on where identity and authentication are headed next.
👉 Read OneSpan's recap of the FIDO Alliance seminar on phishing-resistant authentication →
Passkeys and FIDO: what IAM teams need to change now?
Explore further
12/06/2026 11:08 pm
Phishing-resistant authentication is now the minimum viable control for exposed identity paths. The article correctly treats phishing proxies and adversary-in-the-middle attacks as a structural break in legacy MFA assumptions. Once the login ceremony can be relayed, the control no longer verifies presence in the way the programme thinks it does. Practitioners should stop evaluating MFA as a generic bucket and separate interceptable factors from phishing-resistant authenticators.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Which frameworks should guide phishing-resistant authentication decisions?
A: NIST SP 800-63 is the clearest fit for authentication assurance and phishing-resistant methods, while the NIST Cybersecurity Framework 2.0 helps place those controls inside a broader governance model. If AI-mediated identity risk is in scope, teams should also align with AI governance processes so access decisions and model usage are controlled together.
👉 Read our full editorial: Phishing-resistant authentication is now the baseline for identity
