Topic starter
12/06/2026 10:09 pm
TL;DR: Phishing remains a common access path to ransomware even as national strategy attention stays uneven, according to Axiad’s analysis, which cites CISA data showing 84% of employees interacted with a phishing email. The practical gap is that not all MFA resists phishing, so certificate-based authentication changes the trust model rather than just adding another login step.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Fresh Take: A Brief Reflection on the National Cybersecurity Strategy”.
By the numbers:
- 84% of employees interacted with a phishing email, according to CISA data cited by Axiad.
Key questions
Q: How should security teams prioritise phishing-resistant authentication in a zero trust programme?
A: Security teams should treat phishing-resistant authentication as a foundational control, not a niche enhancement.
Q: When does strong MFA still leave identity risk too high?
A: Strong MFA still leaves risk too high when recovery and revocation paths are weak.
Q: What signs show that an authentication programme is not truly phishing resistant?
A: Look for shared secrets, OTP dependence, push fatigue risks, and exceptions for privileged users.
Practitioner guidance
- Replace phishable MFA on high-risk access paths Move administrative, financial, and privileged workflows to phishing-resistant methods such as certificate-based authentication or hardware-bound FIDO flows.
- Inventory authentication methods by assurance level Map SMS, OTP, push, FIDO, and certificate-based methods to specific user groups and applications, then identify where the current factor still permits phishing relay or social engineering.
- Tie zero trust policy to method resistance Define which access paths require cryptographic proof, device binding, and continuous re-verification, then remove any method that cannot meet the assurance target for that path.
Bottom line: Phishing-resistant authentication is about resisting replay and relay attacks, not simply adding a second step to login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/06/2026 12:43 am
Phishing resistance is an authentication assurance problem, not a user-behaviour problem: The control failure starts when programmes treat any second factor as equivalent protection. SMS, OTP, and push approvals can still be phished, relayed, or socially engineered, so the real question is whether the method cryptographically binds the authentication event to the intended device and origin. Practitioners should evaluate assurance by attack resistance, not by MFA label.
A question worth separating out:
Q: Should organisations prioritise continuous authentication over more MFA?
A: Yes, when the main risk is post-authentication attack, session theft, or privilege abuse after login. More MFA can reduce some account takeover risk, but it does not solve the trust window that remains open after authentication. Continuous authentication is the stronger choice when sessions, tokens, and machine identities drive operational risk.
👉 Read our full editorial: Phishing resistance and certificate-based authentication in zero trust