Topic starter
12/06/2026 10:22 pm
TL;DR: Credential stuffing, phishing, smishing, vishing, and stolen-session attacks continued to drive major breaches in 2023, with Axiad citing Apple, IBM, Norton LifeLock, 23andMe, and Okta as evidence that passwords and basic MFA no longer withstand modern attack chains. The security baseline has shifted to phishing-resistant authentication, not stronger password policy.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Top Data Breaches in 2023 and Why Organizations Need Passwordless, Phishing-Resistant Authentication”.
By the numbers:
- In 2023, data breaches were up by 20% over 2022, according to a study from Apple cited by Axiad.
Key questions
A: The first move is to identify the most sensitive applications and administrative accounts, then require MFA there before expanding broadly.
Q: Why do OTP based MFA flows still fail against modern phishing and adversary in the middle attacks?
A: OTP based MFA fails because it assumes the user who receives a code is the legitimate user.
Q: How do you know if phishing-resistant MFA is actually working?
A: Look for enrolment coverage by user group, renewal discipline, exception rates, and the absence of weak fallback methods.
Practitioner guidance
- Prioritise phishing-resistant authenticators for high-risk access Move privileged users, admins and support workflows to authenticators that cannot be replayed from a fake site, especially where account takeover would expose customer data or tenant-level access.
- Retire SMS, voice and OTP as trusted second factors Classify these methods as transitional, not durable, controls for sensitive access because they can still be intercepted, proxied or socially engineered.
- Harden recovery and support workflows Treat help-desk and account recovery paths as part of the authentication surface, since stolen credentials often become session tokens through those workflows.
Bottom line: Passwords, SMS codes and generic MFA are no longer enough to stop contemporary phishing and credential replay attacks.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 1:04 am
Password-based authentication is now a liability surface, not an assurance layer: Once credentials can be phished, stuffed, reused or replayed, the authentication step stops proving user legitimacy. That is especially true when the same credential can unlock multiple services or tenant-adjacent workflows. The implication is that identity programmes should stop treating passwords as a default control for meaningful access decisions.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: What is the difference between stronger MFA and phishing-resistant authentication?
A: Stronger MFA usually means adding more factors, but phishing-resistant authentication changes the architecture so the factor cannot be easily replayed or proxied. FIDO2 is the clearest example because it binds authentication to the origin and keeps the private key on the device, which reduces interception risk.
👉 Read our full editorial: Why passwordless, phishing-resistant MFA is now the baseline
This post was modified 6 days ago by NHI Mgmt Group