Topic starter
25/06/2026 1:17 am
TL;DR: Device-bound login and origin checks cut phishing risk by removing reusable secrets, with RSA Security reported to show that passwords and OTP-based MFA still face interception, replay, and fake portals. IAM teams need to manage the mixed-control period carefully as passwordless methods replace weaker login steps.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Phishing-Resistant Passwordless Best Practices: Read the Gartner® Report”.
By the numbers:
- 87% of companies are either deploying or plan to deploy passkeys to enhance security and user experience, according to RSA Security.
Key questions
Q: Why do phishing-resistant methods reduce account takeover risk?
A: They reduce account takeover risk because the attacker cannot easily steal a reusable secret and use it somewhere else.
Q: How should IAM teams implement passwordless authentication without breaking customer journeys?
A: Start with hybrid deployment in new or low-risk flows, then expand to existing journeys once recovery, fallback, and step-up rules are proven.
Q: What breaks when organisations rely on OTP codes as the main defence against phishing?
A: OTP alone breaks when attackers can proxy the legitimate login session and harvest the code as the user enters it.
Practitioner guidance
- Inventory every password and OTP dependency Map where passwords, SMS codes, email OTPs, authenticator-app OTPs, and legacy fallback methods are still used across workforce and customer access.
- Prioritise device-bound methods for high-value access Move privileged, regulated, and customer-facing access toward passkeys, hardware keys, smart cards, or other methods that bind authentication to the device or origin.
- Separate phishing-resistant from multi-factor in policy Write policy so teams do not describe every MFA method as phishing-resistant.
Bottom line: Phishing-resistant authentication reduces risk by removing reusable secrets from the login flow and binding proof to the device or origin.
Glossary terms: Passwordless Authentication, Phishing-Resistant Authentication, Device binding, Origin binding
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 10:36 am
Phishing resistance is now an authenticator baseline, not a premium feature. Passwords and OTP-based MFA still leave the organisation exposed to replay, interception, and fake portal attacks. That means IAM programmes should stop treating passwordless as an optional enhancement and start treating phishing resistance as the minimum acceptable authentication property for high-value access.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Should organisations treat passkeys, hardware keys, and biometrics the same way?
A: No. They can all support phishing-resistant authentication, but they do not provide the same operational profile. IAM teams should compare how each method binds to the device, how it handles fallback, and whether it remains resistant when users are away from managed endpoints. The right choice depends on the access journey, not the label.
👉 Read our full editorial: Passwordless authentication should replace reusable secrets first
This post was modified 1 day ago by NHI Mgmt Group