Notifications
Clear all
Topic starter
02/09/2026 3:58 pm
TL;DR: Phishing remains the dominant entry point for account takeover, with the source article citing a 91% breach-start rate, a 30% click rate on targeted phish, and under 60 seconds from click to credential theft. SecureAuth argues that AI-generated lures and pixel-perfect replicas have pushed CIAM, not awareness training alone, to the front line of defence.
NHIMG editorial — based on content published by SecureAuth: phishing-resistant CIAM against modern phishing and account takeover
By the numbers:
Questions worth separating out
Q: What should security teams do first when phishing keeps leading to account takeover?
A: Start with the journeys most exposed to credential replay, then replace phishable factors with phishing-resistant authentication where the business impact is highest.
Q: Why do phishing-resistant MFA methods reduce account takeover risk more than codes or SMS?
A: They bind the credential to the legitimate domain, so a fake login page cannot capture a reusable secret.
Q: How can teams tell whether phishing controls are actually working?
A: Look for fewer successful credential submissions on lookalike domains, lower password reuse, and faster reporting of suspicious messages.
Practitioner guidance
- Deploy phishing-resistant authentication for high-risk journeys Use FIDO2 passkeys or equivalent phishing-resistant methods for customer accounts, admin portals, and recovery flows where credential replay is unacceptable.
- Add adaptive step-up controls to the login path Trigger additional verification when device, location, or behavioural signals shift unexpectedly, and do it before the session becomes fully trusted.
- Instrument session monitoring for post-login abuse Track impossible travel, new device usage, and anomalous navigation so the platform can terminate or lock sessions after suspicious access begins.
What's in the full article
SecureAuth's full blog post covers the operational detail this post intentionally leaves for the source:
- Step-by-step CIAM defence layers for phishing-resistant authentication, detection, and response
- Specific MFA method comparisons, including when passkeys outperform SMS and TOTP in practice
- Examples of behavioural signals used for real-time login risk scoring and session challenge decisions
- Customer identity implementation detail for retail, e-commerce, and financial services environments
👉 Read SecureAuth's analysis of phishing-resistant CIAM and account takeover →
Phishing-resistant CIAM and credential theft: are your controls ready?
Explore further
02/09/2026 3:58 pm
Phishing has become an identity control failure, not just a user-behaviour problem. The article is right to push CIAM to the front line because the attack now ends at authentication, not at email delivery. Awareness training still has value, but it cannot absorb the speed and realism of AI-generated lures. The practical conclusion is that identity programmes must assume successful clicks and focus on making stolen credentials non-portable or non-actionable.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A further 47% have only partial visibility into those connected vendors, which means access pathways can remain ungoverned long after the initial trust decision.
A question worth separating out:
A: They should do both, but not as equals. Training helps reduce careless behaviour, while stronger authentication and real-time risk controls stop the breach when training fails. In practice, identity controls should be designed as the decisive barrier and training should reinforce, not substitute for, that barrier.
👉 Read our full editorial: Phishing-resistant CIAM is now the first line of defense
