Notifications
Clear all
Topic starter
10/07/2026 4:15 pm
TL;DR: Basic MFA methods are being bypassed through Adversary-in-the-Middle proxy attacks, MFA fatigue, and social engineering, while phishing-resistant MFA uses cryptography and domain binding to stop credential interception, according to Versasec. The governance issue is no longer whether MFA exists, but whether it can survive real phishing conditions and lifecycle scale.
NHIMG editorial — based on content published by Versasec: Beyond the Basics: Why Enterprises Need Phishing-Resistant MFA
By the numbers:
- The U.S. federal government has required phishing-resistant MFA across its agencies since OMB Memorandum M-22-09.
Questions worth separating out
Q: How should security teams implement phishing-resistant MFA for privileged access?
A: Start with the accounts most exposed to phishing, such as admins, finance approvers, and remote access users.
Q: Why do basic MFA methods still fail against modern phishing attacks?
A: Because many basic MFA methods rely on factors that can be relayed, replayed, or socially engineered in real time.
Q: What do security teams get wrong about phishing-resistant MFA?
A: They often focus on the authenticator type and ignore the operational layer around it.
Practitioner guidance
- Replace phishable MFA on high-risk accounts Move privileged users, admins, finance approvers, and remote-access accounts to FIDO2, WebAuthn, or certificate-based authentication where the login request is origin-bound and not relayed through a shared secret.
- Align credential lifecycle with authentication design Define issuance, replacement, PIN reset, revocation, and offboarding workflows before rollout.
- Use a credential management system for scale Centralise provisioning and audit trails for smart cards, security keys, and passkeys so helpdesk handling does not become the weakest point in the authentication chain.
What's in the full article
Versasec's full article covers the operational detail this post intentionally leaves for the source:
- Why the vendor distinguishes FIDO2, WebAuthn, and PKI as the practical phishing-resistant options
- How its credential management approach ties issuance, replacement, and revocation into one workflow
- Where the article maps phishing-resistant MFA to U.S. federal guidance and CISA recommendations
- What enterprise credential administration looks like when hardware-backed authentication is rolled out at scale
👉 Read Versasec's analysis of phishing-resistant MFA and credential lifecycle management →
Phishing-resistant MFA: are your login controls still easy to phish?
Explore further
10/07/2026 4:17 pm
Phishable MFA is a trust model problem, not a factor-counting problem. Organisations often treat any second factor as sufficient, but the article shows why that assumption breaks under proxy interception and social engineering. The control failure is not just weaker authentication, it is the belief that a reusable or relayed factor can prove session legitimacy. Practitioners should stop equating MFA presence with phishing resistance.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- A separate finding shows that 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, including 38% with no or low visibility and 47% with only partial visibility, according to The State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when a phishing-resistant MFA rollout fails?
A: Accountability sits with both identity governance and the teams operating credential lifecycle processes. If a certificate, key, or passkey is not revoked, replaced, or recovered correctly, the failure is not only technical. It is a governance issue that spans authentication policy, helpdesk execution, and offboarding discipline.
👉 Read our full editorial: Phishing-resistant MFA exposes the limits of basic login controls
