Topic starter
10/07/2026 9:22 pm
TL;DR: The UK NCSC compared passkeys with traditional MFA attack by attack and concluded that passkeys outperform every form of traditional MFA against the attacks currently seen in the wild, especially adversary-in-the-middle phishing and session theft, according to Authsignal's summary of the paper. The practical shift is that authentication design now needs phishing-resistant controls, not just an added factor.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “The UK’s NCSC made the strongest official case for passkeys”.
By the numbers:
- Password brute-force and credential stuffing together account for 97% of attacks, according to the NCSC paper cited by Authsignal.
- Adversary-in-the-middle phishing sits at 0.24% of attacks, according to the NCSC paper cited by Authsignal.
- MFA fatigue attacks account for 0.003% of attacks, according to the NCSC paper cited by Authsignal.
Key questions
Q: What should teams do first when traditional MFA is still their default login control?
A: Start by identifying where the organisation still depends on phishable factors such as SMS OTP, TOTP, push approval, or email codes.
Q: Why do passwordless methods reduce phishing risk more than traditional MFA?
A: Passwordless reduces phishing risk because it removes the reusable password that attackers most often steal or replay.
Q: What signs show that an authentication programme is not truly phishing resistant?
A: Look for shared secrets, OTP dependence, push fatigue risks, and exceptions for privileged users.
Practitioner guidance
- Prioritise phishing-resistant authentication Move high-risk and externally exposed applications toward passkeys or other phishing-resistant authenticators before expanding low-assurance MFA methods.
- Remove phishable fallback paths Review password, SMS OTP, TOTP, push approval, and email-code fallbacks so a user cannot be silently downgraded to a weaker path after passkey adoption begins.
- Harden sync-account protections Treat the account that stores or syncs credentials as a high-value identity and require phishing-resistant authentication on that account as well.
Bottom line: Traditional MFA still leaves a phishable surface when attackers can relay or coerce credentials in real time.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Phishability, not factor count, is the real authentication boundary: The article reinforces a problem we see repeatedly in identity programmes, where teams confuse added friction with stronger assurance. Traditional MFA can still be relayed, proxied, or coerced, so the meaningful control question is whether the credential can be replayed against an attacker-controlled endpoint. Practitioners should treat phishable second factors as a design limitation, not an implementation detail.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations replace traditional MFA with passkeys and adaptive controls?
A: For most programmes, yes for the primary path and no for everything else. Passkeys should become the preferred method where device support allows it, while adaptive controls decide when extra checks are needed. Traditional MFA can remain as fallback, but it should no longer be the default for every login.
👉 Read our full editorial: Passkeys outperform traditional MFA against live phishing attacks