Topic starter
08/06/2026 5:08 pm
TL;DR: Phishing remains the most likely attack for 49% of respondents, while 64% cite fear of change as the main reason they keep passwords and non-phishing-resistant MFA, according to Axiad’s 2023 State of Authentication Survey. Removing the human step is only part of the answer; authentication strategy still has to align with real IAM, rollout, and lifecycle constraints.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “How to Adopt Phishing-Resistant MFA”.
By the numbers:
- 49% of respondents said phishing is the most likely attack to happen.
- 64% of respondents said fear of change is the top reason for holding onto passwords and non-phishing-resistant MFA.
Key questions
Q: How should organisations implement phishing-resistant MFA for regulated access?
A: Start by mapping each protected system to the identity type that uses it, then choose a phishing-resistant method that fits that subject.
Q: Why does slow adoption of phishing-resistant MFA keep organisations exposed to credential attacks?
A: Phishing-resistant MFA reduces the value of stolen passwords because the attacker still cannot complete authentication with a replayed secret.
Q: What breaks when phishing-resistant MFA is not in place for regulated systems?
A: When phishing-resistant MFA is missing, a single phishing message can expose authenticated access paths that regulators expect to be stronger.
Practitioner guidance
- Define user cohorts by risk and function Split identities into operationally meaningful groups such as IT, finance, executives, and standard staff, then assign stronger authentication first to the groups with the highest exposure and privilege.
- Inventory every human-mediated MFA flow Locate any login path that still depends on a typed code, push approval, or reusable secret, because those flows remain susceptible to phishing and should be prioritised for replacement.
- Extend existing IAM instead of replacing it Plan phishing-resistant MFA as an overlay to current IAM and identity provider architecture so rollout does not require a rip-and-replace migration.
Bottom line: Phishing-resistant MFA is not blocked by the technology alone. It is blocked when authentication strategy does not fit the organisation’s existing identity design and operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 7:09 pm
Phishing-resistant MFA fails as a point solution when identity architecture is fragmented. The article is right to push beyond technology choice and into operating model, because authentication strength cannot be separated from how identities are grouped, recovered, and administered. In most enterprises, the blocker is not cryptography but the mismatch between a stronger authenticator and a fragmented IAM estate. The practitioner lesson is that phishing resistance is an identity programme decision, not a checkbox upgrade.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between certificate-based authentication and FIDO in practice?
A: Certificate-based authentication is strongest where device-bound trust and managed issuance are needed, while FIDO is often better where supported applications and user experience matter most. Many enterprises need both. The decision is less about which method is better overall and more about which one fits the access path, platform, and assurance requirement.
👉 Read our full editorial: Phishing-resistant MFA adoption still hinges on identity design
This post was modified 4 days ago by NHI Mgmt Group