Topic starter
02/09/2026 3:58 pm
TL;DR: Phishing remains the dominant entry point for account takeover, with the source article citing a 91% breach-start rate, a 30% click rate on targeted phish, and under 60 seconds from click to credential theft. SecureAuth argues that AI-generated lures and pixel-perfect replicas have pushed CIAM, not awareness training alone, to the front line of defence.
Editorial analysis by NHI Mgmt Group, based on content published by SecureAuth: “Why Phishing is Still a Top Threat and How CIAM Can Stop It”.
By the numbers:
- 91% of breaches start with phishing.
- 30% is the click rate on targeted phish.
- Credential theft happens in under 60 seconds after a click.
Key questions
Q: What breaks when customer accounts still rely on phishable login factors?
A: The break is that stolen credentials remain reusable against the real service, so a successful phish can become account takeover in seconds.
Q: Why does phishing remain effective even when employees are trained?
A: Phishing remains effective because attackers exploit urgency, familiarity, and normal business processes, which can overwhelm training in the moment.
Q: How do real-time risk signals improve CIAM security?
A: They let the system react during the authentication session instead of waiting for an incident review.
Practitioner guidance
- Adopt phishing-resistant authenticators for high-value journeys Use FIDO2 passkeys or equivalent phishing-resistant methods for customer accounts that can move money, expose personal data or trigger account recovery.
- Add real-time risk scoring to the login flow Combine device fingerprinting, behavioural signals, geo-velocity checks and session monitoring so suspicious authentications can be challenged before account takeover completes.
- Harden recovery and step-up paths Treat password resets, MFA enrolment and recovery contacts as attack targets because phishing often succeeds by moving through the weakest identity path after initial compromise.
Bottom line: Phishing is still effective because modern lures can be personalised, automated and fast enough to steal credentials before users or defenders react.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/09/2026 3:58 pm
Phishing-resistant CIAM is now the front line because the attack has moved inside the authentication ceremony. Once attackers can produce believable lures and replicas at scale, awareness training becomes a weak upstream control rather than a stopping point. The control question shifts to whether the identity layer can make replayable credentials unusable against the legitimate domain. Practitioners should treat the login flow itself as the place where phishing must fail.
A few things that frame the scale:
- Roughly 1 in 3 phishing payloads are delivered outside email, through channels such as social media, search ads and messaging apps.
A question worth separating out:
Q: Should organisations prioritise continuous authentication over more MFA?
A: Yes, when the main risk is post-authentication attack, session theft, or privilege abuse after login. More MFA can reduce some account takeover risk, but it does not solve the trust window that remains open after authentication. Continuous authentication is the stronger choice when sessions, tokens, and machine identities drive operational risk.
👉 Read our full editorial: Phishing-resistant CIAM is now the first line of defense
This post was modified 2 days ago by NHI Mgmt Group