Topic starter
12/06/2026 10:08 pm
TL;DR: Gartner IAM Summit takeaways argue that MFA is now baseline hygiene, but the real risk sits in phishing-resistant implementation, hybrid authenticator choice, and credential enrollment and account recovery paths that attackers can exploit, according to Axiad. The governance issue is no longer whether to add MFA, but whether identity recovery and enrolment processes weaken the control you think you have.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Fresh Take: Our Five Key Takeaways from the 2023 Gartner® Identity & Access Management Summit in Texas”.
Key questions
Q: How can teams migrate from MFA to passwordless without breaking access?
A: Move in stages. Start with applications and user groups that support modern standards, keep a controlled fallback for edge cases, and verify that recovery, device enrolment, and help desk processes are ready before expansion. The migration succeeds when assurance stays visible during the transition.
Q: Why do social engineering attacks still bypass strong MFA programs?
A: Strong MFA can still fail if attackers can reset the factor through support channels or exhaust users with push prompts.
Q: What are the best practices for deploying passkeys and certificate-based authentication?
A: Start with high-risk access paths, define which user populations need stronger authenticators, and keep recovery flows aligned with the same assurance level.
Practitioner guidance
- Map the full CEAR workflow Document every enrollment and recovery step, including who can initiate it, what proof is accepted, and where manual support overrides exist.
- Remove weak recovery methods Eliminate temporary passwords and knowledge-based authentication from account recovery wherever possible, and replace them with stronger self-service proofing.
- Prioritise phishing-resistant authenticators Use FIDO2 passkeys, certificate-based authentication, or PKI-backed methods for high-value access paths and sensitive user populations.
Bottom line: Passwordless MFA reduces dependence on passwords, but it does not remove identity risk if enrollment and recovery remain weak.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:41 am
CEAR is the weak control plane in many passwordless programmes: The article’s central insight is that phishing-resistant MFA only shifts the attack surface if enrollment and recovery are governed with equal discipline. Temporary passwords, knowledge-based authentication, and help-desk-driven resets reintroduce the very bypass paths passwordless aims to remove. Practitioners should treat CEAR as part of authentication assurance, not a side process.
A question worth separating out:
Q: How should organisations design MFA so users actually adopt it without weakening assurance?
A: Organisations should make MFA easy enough that people use it consistently, but strong enough to verify the person at the point of access. The best approach is to reduce friction without relying on shared or stealable factors alone. A strong implementation combines usability, phishing resistance, and high identity assurance, so security does not collapse when a device, token, or code is unavailable.
👉 Read our full editorial: Passwordless MFA and recovery controls reduce identity risk