Topic starter
12/06/2026 10:17 pm
TL;DR: Phishing resistance is becoming a board-level priority because identity-related breaches are common, phishing remains the dominant breach type, and fragmented IAM estates leave inconsistent MFA coverage, according to Axiad and cited industry research. The real issue is not whether MFA exists, but whether it is resistant to interception, replay, and bypass across every authentication path.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Why Phishing-Resistant MFA is Critical in 2023, And How CBA Can Help”.
By the numbers:
- 84% said their organization had experienced an identity-related breach in the past year.
- phishing attacks were the most common breach type at 59%, whether broad-based attacks or spear phishing.
- 70% of organizations use 3 or more IAM systems across their organization.
Key questions
Q: What breaks when phishing-resistant MFA is not in place for regulated systems?
A: When phishing-resistant MFA is missing, a single phishing message can expose authenticated access paths that regulators expect to be stronger.
Q: Why do fragmented IAM estates increase phishing risk?
A: Fragmentation creates different authentication rules across systems, so one application may enforce stronger MFA while another still accepts weaker methods.
Q: How do you know if phishing-resistant MFA is actually working?
A: Look for enrolment coverage by user group, renewal discipline, exception rates, and the absence of weak fallback methods.
Practitioner guidance
- Map authentication paths across every IAM system Inventory which login flows still rely on SMS, push approval, or other relayable factors, then rank them by exposure and user privilege.
- Eliminate weaker MFA methods on high-risk access paths Remove SMS and other replayable methods from admin, remote access, and sensitive application sign-in flows before attackers exploit the weakest route.
- Standardise phishing-resistant authentication across the estate Use one governed control pattern for all major IAM systems so security policy does not vary by platform, business unit, or operating system.
Bottom line: Phishing-resistant MFA addresses replay and interception risk, but fragmented IAM estates can still leave weaker login paths open.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
13/06/2026 12:58 am
Phishing-resistant MFA is now a governance consistency problem, not just an authentication choice. The article shows that organisations can have MFA in place and still remain exposed when the methods differ across IAM systems. That means the real control question is whether every authentication path is resistant to interception and replay, not whether MFA exists somewhere in the stack.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations replace legacy MFA before unifying IAM systems?
A: Yes, for the highest-risk users and access paths. A fragmented estate can preserve weak methods even after a modern IAM rollout, so removing the most abusable factors first reduces immediate exposure. Organisations should prioritise the sign-in paths that reach administrative, remote, or sensitive business systems, then standardise the stronger method across the rest of the estate.
👉 Read our full editorial: Phishing-resistant MFA remains a gap in fragmented IAM estates
This post was modified 5 days ago by NHI Mgmt Group