Topic starter
26/08/2026 11:51 am
TL;DR: A widening gap between security perception and actual authentication hygiene is evident in a 2025 global survey of 18,000 employed adults across nine countries, according to Yubico. The practical lesson is that phishing resistance now spans human identity, digital identity, and emerging NHI trust models, not just password replacement, including 70% who say AI has made phishing more successful and 29% who still lack MFA on personal email.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “The future of authentication in 2026: Insights from Yubico’s experts”.
By the numbers:
- 70% believe phishing attempts have become more successful due to the use of AI.
Key questions
Q: How should security teams reduce phishing success without relying on user vigilance alone?
A: They should move controls into the authentication flow.
Q: Why does AI-driven phishing change identity security decisions?
A: It lowers the reliability of human judgment in routine trust checks, which means organisations need stronger process controls.
Q: When do non-human identities need the same trust controls as human users?
A: When those identities can initiate access, move data, or participate in delegated workflows that affect business systems.
Practitioner guidance
- Prioritise phishing-resistant authentication Replace the highest-risk password and OTP-dependent access paths with device-bound, phishing-resistant methods first, starting with administrators, privileged users, and high-impact business accounts.
- Map every fallback and recovery path Inventory password resets, recovery codes, helpdesk resets, and exception flows because attackers often target the weakest path rather than the primary login method.
- Extend identity policy to non-human access Apply ownership, verification, and offboarding rules to service accounts, automation, and delegated identities so machine trust is not exempt from phishing-resistance governance.
Bottom line: AI-assisted phishing is widening the gap between perceived and actual authentication resilience, especially where passwords and fallback workflows still dominate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishing resistance is now an identity governance discipline, not a single control choice. The article shows that AI is amplifying the pressure on authentication while basic MFA adoption still lags in everyday use. That gap is not just a user-behaviour problem. It is a programme design problem that spans login assurance, recovery paths, and the lifecycle of trusted identities. Practitioners should treat phishing resistance as a governance outcome, not a feature checklist.
A question worth separating out:
Q: What should IAM teams do first after finding a weak MFA implementation?
A: Reassess the exposed population, tighten server-side throttling, and accelerate migration for privileged and externally reachable users. The immediate goal is to remove the easiest bypass path while you redesign the longer-term authentication standard. In practice, that means treating the flaw as both a security incident and an identity design problem.
👉 Read our full editorial: Phishing resistance and NHI governance are converging in 2026