Topic starter
26/08/2026 11:51 am
TL;DR: Gen Z is the most susceptible demographic to phishing, with 62% reporting a scam encounter in the past year, according to Yubico, and the article argues that accessible phishing-resistant authentication and hands-on education are needed to close the digital safety gap. That matters because identity programmes fail when stronger controls remain unavailable to the users most likely to be targeted.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “Secure it Forward: Yubico and Best Buy Foundation® bring digital security to teens”.
By the numbers:
- Gen Z remains highly exposed to phishing, with 62% reporting engagement with a scam in the past year, according to Yubico.
Key questions
Q: How should teams deploy phishing-resistant authentication for younger or first-time users?
A: Start with the users who are most likely to be lured by phishing and make the strongest factor easy to enrol, understand, and recover.
Q: Why does phishing-resistant authentication still fail if users are not trained?
A: Because the control protects the account, but training protects the decision to trust a prompt, link, or request.
Q: What are the signs that a phishing protection programme is not reaching the right users?
A: Look for uneven enrollment, low repeat use, confusion during setup, and users who still rely on passwords or OTP codes after security keys are available.
Practitioner guidance
- Map first-touch identity education into access strategy Identify where new or younger users first form account habits, then make phishing-resistant authentication and plain-language guidance available at that entry point.
- Pair strong authentication with hands-on setup support Provide step-by-step onboarding, live demonstrations, and simple recovery guidance so the user can adopt the control without guessing how it works.
- Measure who can actually use your strongest factor Track not only enrollment but practical use, comprehension, and repeated adoption across user groups that are most exposed to scams.
Bottom line: The article ties Gen Z phishing exposure to a broader identity gap: stronger authentication is available, but not always to the users most at risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishing-resistant authentication only works when it reaches the user before bad habits form: The control problem here is not whether hardware-backed authentication is stronger, but whether the strongest option is available early enough to shape account behaviour. A youth programme that pairs access with hands-on guidance closes the gap between capability and adoption. The practitioner lesson is to treat deployment timing as part of assurance.
A question worth separating out:
Q: Should identity teams treat youth access and workforce access the same way?
A: No. Workforce IAM assumes managed onboarding, owned devices, and formal support channels, while youth and first-time users often need a simpler access path and more guidance. If the delivery model is different, the identity governance model should be different too.
👉 Read our full editorial: Phishing-resistant keys for teens highlight the Gen Z identity gap