Topic starter
22/06/2026 4:56 pm
TL;DR: Phishing-resistant MFA binds the authentication ceremony to the relying-party origin, making phishing-site replay and man-in-the-middle relays ineffective; CISA, OMB M-22-09, and regulated sectors now treat it as the practical baseline, according to Scramble ID. The governance question is no longer whether MFA exists, but whether the authentication path can actually survive hostile session proxying.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “What Is Phishing-Resistant MFA? The Authentication Bar That AI Cannot Defeat”.
Key questions
Q: How should organisations phase out legacy MFA for sensitive access?
A: Start with privileged users, supplier access, and systems tied to regulated or sensitive data.
Q: Why do AiTM phishing kits still succeed against MFA?
A: AiTM kits succeed because they capture the authenticated session, not just the password.
Q: What breaks when recovery flows are not phishing-resistant?
A: The assurance claim breaks at the point of reset, not at the point of login.
Practitioner guidance
- Inventory every authentication path Map web, mobile, desktop, partner, recovery and support-assisted login flows to see where relayable factors still exist.
- Replace relayable factors in high-risk flows Prioritise privileged access, customer-data export and sensitive transaction approval for phishing-resistant authenticators such as FIDO2/WebAuthn or PKI-based methods.
- Harden recovery and fallback Make sure password resets, device replacement, help-desk verification and break-glass access do not fall back to weaker factors that undermine the primary control.
Bottom line: Phishing-resistant MFA changes the control conversation from factor count to origin-bound proof, which is the property that blocks relay-based phishing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:07 pm
Phishing-resistant MFA is now an identity assurance baseline, not an enhancement. The old assumption that any MFA meaningfully raises assurance no longer holds once attackers can proxy the entire ceremony. That collapse is not about factor count, it is about whether the authenticator can prove the real relying-party origin. The implication is that identity teams must stop measuring MFA by deployment volume and start measuring it by resistance to relay and replay.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between strong MFA and phishing-resistant MFA?
A: Strong MFA means more than one factor is used, while phishing-resistant MFA means the factor cannot be easily captured and replayed by an attacker. A code sent by text may count as MFA, but it is not resistant enough for high-risk accounts because the secret can be stolen outside the application itself. Resistance is the higher standard.
👉 Read our full editorial: Phishing-resistant MFA is the new bar for identity assurance