Topic starter
08/06/2026 5:05 pm
TL;DR: Passkeys and phishing-resistant authentication are forcing IAM teams to move beyond MFA patterns that attackers now bypass with real-time phishing proxies and social engineering, according to OneSpan. The practical reset is not just stronger login methods, but an access design that assumes shared secrets are the weak point.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Retour à l'identité : L'alliance FIDO et l'avenir de l'authentification résistante à l'hameçonnage”.
Key questions
Q: How should security teams replace MFA flows that attackers can proxy in real time?
A: Security teams should prioritise phishing-resistant authentication for the accounts and transactions that would be most damaging if relayed or replayed.
Q: Why do passkeys reduce phishing risk compared with passwords?
A: Passkeys are bound to the original website and use cryptographic proof instead of a reusable secret.
Q: What signs show that an authentication programme is still too easy to relay?
A: Look for login methods that still succeed after a user is redirected through a proxy, repeated prompts that do not bind to the target site, and frequent help-desk recovery after authentication failures.
Practitioner guidance
- Prioritise phishing-resistant authenticators for high-risk journeys Move privileged staff, customer, and sensitive transaction flows to phishing-resistant authentication first, before broad rollout elsewhere.
- Separate passkey strategy by assurance level Use synced passkeys where usability is the main constraint, and reserve hardware-bound authenticators for privileged access, regulated workflows, and other high-assurance use cases.
- Map AI-enabled access paths into identity governance Review where AI systems, automation, or adaptive decisioning are consuming identity assertions, because those paths now sit inside the same trust boundary as human authentication.
Bottom line: Passkeys and phishing-resistant authentication shift IAM away from credentials that can be intercepted, relayed, and replayed during live attacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 hours ago by NHI Mgmt Group
08/06/2026 7:05 pm
Phishing resistance is now an authentication baseline, not an advanced option. Once adversaries can relay sessions in real time, the question is no longer how many factors a programme uses but whether the authenticator can be intercepted at all. Shared-secret and push-based patterns still leave a relay window that attackers can exploit. Practitioners should treat phishing resistance as the minimum standard for any access path that matters.
A question worth separating out:
Q: What changes when identity is used to govern both users and AI-enabled access paths?
A: The programme has to govern more than human sign-in. It must decide how trust is asserted for systems, automations, and AI-mediated actions that now consume identity assertions and data access rights. That expands identity from access entry to access orchestration, which means policy, assurance, and monitoring all need to follow the same trust boundary.
👉 Read our full editorial: FIDO passkeys and phishing-resistant authentication are resetting IAM
This post was modified 4 hours ago by NHI Mgmt Group