Topic starter
25/06/2026 1:17 am
TL;DR: Passwords and OTP-based MFA remain vulnerable to interception, replay, and fake login portals, while phishing-resistant methods bind authentication to device or origin and remove shared secrets, according to RSA Security and Gartner. The real shift is not convenience, but reducing credential theft by changing what the authenticator trusts.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Phishing-Resistant Passwordless Best Practices: Read the Gartner® Report”.
By the numbers:
- 87% of companies are either deploying or plan to deploy passkeys to enhance security and user experience, according to RSA Security.
Key questions
Q: What breaks when organisations rely on OTP codes as the main defence against phishing?
A: OTP alone breaks when attackers can proxy the legitimate login session and harvest the code as the user enters it.
Q: Why do phishing-resistant methods reduce account takeover risk?
A: They reduce account takeover risk because the attacker cannot easily steal a reusable secret and use it somewhere else.
Q: How should IAM teams implement passwordless authentication without breaking customer journeys?
A: Start with hybrid deployment in new or low-risk flows, then expand to existing journeys once recovery, fallback, and step-up rules are proven.
Practitioner guidance
- Inventory every password and OTP dependency Map where passwords, SMS codes, email OTPs, authenticator-app OTPs, and legacy fallback methods are still used across workforce and customer access.
- Prioritise device-bound methods for high-value access Move privileged, regulated, and customer-facing access toward passkeys, hardware keys, smart cards, or other methods that bind authentication to the device or origin.
- Separate phishing-resistant from multi-factor in policy Write policy so teams do not describe every MFA method as phishing-resistant.
Bottom line: Phishing-resistant authentication reduces risk by removing reusable secrets from the login flow and binding proof to the device or origin.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:36 am
Phishing resistance is now an authenticator baseline, not a premium feature. Passwords and OTP-based MFA still leave the organisation exposed to replay, interception, and fake portal attacks. That means IAM programmes should stop treating passwordless as an optional enhancement and start treating phishing resistance as the minimum acceptable authentication property for high-value access.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Should organisations treat passkeys, hardware keys, and biometrics the same way?
A: No. They can all support phishing-resistant authentication, but they do not provide the same operational profile. IAM teams should compare how each method binds to the device, how it handles fallback, and whether it remains resistant when users are away from managed endpoints. The right choice depends on the access journey, not the label.
👉 Read our full editorial: Phishing-resistant passwordless authentication is becoming the baseline