Topic starter
12/06/2026 9:13 pm
TL;DR: FIDO Alliance seminar takeaways reinforce that phishing proxies, adversary-in-the-middle attacks, and social engineering are eroding the value of traditional MFA, while passkeys and hardware-backed FIDO credentials reduce interception risk, according to OneSpan’s recap of the event. Authentication programmes now need to treat phishing-resistant methods as the default, not an enhancement, because the old trust model is breaking under modern attack pressure.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Back to identity: FIDO Alliance and the future of phishing-resistant authentication”.
By the numbers:
- Phishing attacks increased by 4.2% after the introduction of ChatGPT, according to OneSpan.
Key questions
Q: How should security teams stop reverse proxy phishing from bypassing MFA?
A: Use controls that inspect the session path, not just the credential outcome.
Q: Why do passkeys reduce account takeover risk more effectively than OTP?
A: Passkeys reduce takeover risk because they rely on public-key cryptography rather than shared secrets that can be phished or intercepted.
Q: How should IAM teams decide which users need hardware-backed FIDO credentials?
A: Use the strongest authenticators for roles where a compromised session would create high business or administrative impact, including privileged workforce accounts and sensitive transaction flows.
Practitioner guidance
- Prioritise phishing-resistant authentication for high-risk access Move privileged workforce, admin, and sensitive customer journeys to passkeys or hardware-backed FIDO authenticators where interception risk is highest.
- Separate MFA from phishing resistance in policy Rewrite authentication standards so acceptable methods are ranked by interception resistance, not grouped under a single MFA label.
- Tighten recovery and fallback paths Review help desk resets, account recovery, and backup factors because attackers often bypass strong login methods through weak fallback controls.
Bottom line: Phishing-resistant authentication is now a baseline requirement because real-time phishing methods can defeat conventional MFA.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:08 pm
Phishing resistance has become a baseline control expectation, not an advanced option. Once attackers can relay authentication in real time, the old assumption that MFA meaningfully blocks account takeover no longer holds. That changes the identity programme from factor-counting to interception resistance. Practitioners should stop treating phishing resistance as a premium feature and start treating it as the minimum standard for high-value access.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: What are the best practices for phasing out traditional MFA in a large identity programme?
A: Start by classifying access by risk, then migrate the highest-impact journeys first, including admins, support staff, and users handling sensitive transactions. At the same time, harden recovery, reduce fallback exposure, and measure adoption by segment so the programme does not simply replace one weak factor with another.
👉 Read our full editorial: Phishing-resistant authentication is now the baseline for identity