Topic starter
22/06/2026 5:02 pm
TL;DR: Step-up is increasingly framed as a policy-selected chain of phishing-resistant checks for sensitive actions, not another prompt layer, according to Scramble ID. The governance question is no longer whether step-up exists, but whether it is bound to intent, measurable, and resilient enough to defend high-blast-radius actions, while SMS or voice OTP remains unsuitable for high-risk policies because replay, relay, SIM-swap, and carrier social engineering remain practical bypass paths.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “XFactor: Multi-Step, Phishing-Resistant Step-Up Across Every Channel”.
Key questions
Q: What breaks when step-up is implemented as a generic prompt instead of an action-bound check?
A: A generic prompt proves only that a challenge was answered, not that the answer was tied to a specific sensitive action.
Q: Why do SMS or voice OTPs remain unsuitable for high-risk identity policies?
A: They remain unsuitable because they are readable, relayable, and often socially engineered through SIM swap, carrier compromise, or adversary-in-the-middle phishing.
Q: How can organisations measure whether step-up is working?
A: Measure step-up rate by action, pass and fail rates, time to complete, timeout frequency, and abandon rate.
Practitioner guidance
- Define high-risk action lists Start with the two or three actions that carry the largest blast radius, such as payout destination changes, password resets, device enrollment, or federation key changes.
- Replace reusable secrets for sensitive gates Remove SMS, voice, and email OTP from policies that protect privileged or financially material actions.
- Bind the challenge to the protected action Make the user interface show the exact action being approved, the application or domain requesting it, and the expiry of the request.
Bottom line: High-risk step-up works only when the verification is tied to the protected action and not treated as a generic challenge.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 5:15 pm
Phishing-resistant step-up is an intent-control problem, not a prompt-management problem. The article's strongest insight is that high-risk actions need an approval chain that is cryptographically tied to the action being protected. That is materially different from asking users to satisfy a factor more often. For identity governance, the unit of control shifts from authentication event to action-specific proof, which is the right mental model for privileged workforce flows, customer changes, and custodian-approved machine actions.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: How should identity teams design step-up for workforce and machine-to-machine flows?
A: Use the same governance principle across both: only allow the protected action after a signed, session-bound proof is returned. Workforce flows may use WebAuthn or hardware keys, while machine-to-machine flows may use a human custodian approving a short-lived scoped token. The control objective is the same even when the channel differs.
👉 Read our full editorial: Step-up status shows why phishing-resistant checks must be chained