Topic starter
08/06/2026 4:09 pm
TL;DR: Phishing remains a dominant attack path, with 83% of organisations reporting attacks in 2021 and many traditional MFA schemes still vulnerable to SIM swapping and man-in-the-middle interception, according to Axiad. Phishing-resistant MFA changes the control assumption by removing easily phished one-time codes and pushing authentication toward cryptographic proof instead of reusable secrets.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Importance of Phishing-resistant MFA”.
By the numbers:
- 83% of organizations reported phishing attacks in 2021.
Key questions
Q: What breaks when MFA still depends on codes that users can type into a fake login page?
A: The control breaks at the point where the factor can be intercepted, copied, and replayed by an attacker.
A: They bind the login event to a cryptographic device and the correct origin, so the attacker cannot simply relay a code through a lookalike page.
Q: How should security teams decide where to deploy phishing-resistant MFA first?
A: Start with the accounts and workflows that create the greatest blast radius if compromised, including privileged access, sensitive data access, and business-critical approvals.
Practitioner guidance
- Prioritise phishing-resistant authenticators for privileged users Move administrators, help desk staff, and remote access users to FIDO2/WebAuthn or PIV-backed sign-in first, because their accounts create the highest downstream blast radius.
- Retire interceptable OTP flows for sensitive access Remove SMS, email codes, and other replayable factors from the login paths that protect crown-jewel applications, partner portals, and privileged consoles.
- Classify MFA methods by phishing resistance Document which authenticators can survive fake-login relay attacks, then set policy so high-risk roles are only allowed cryptographic proof factors.
Bottom line: Phishing-resistant MFA matters because traditional OTP-style factors can still be intercepted, replayed, or proxied through fake login pages.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/06/2026 5:38 pm
Phishing-resistant MFA is a control-design response to credential theft, not a user-training substitute. Traditional MFA assumes the second factor can withstand interception long enough to matter. Once attackers can relay or redirect the factor, the control becomes a delay mechanism rather than a barrier, and the governance question shifts to which authenticators are still phishable.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
A: It should be treated as an authentication policy decision within zero trust, not as a cosmetic MFA upgrade. Zero trust assumes continuous verification and reduced trust in the login event, which makes replay-resistant authenticators a more defensible baseline for high-value access paths.
👉 Read our full editorial: Phishing-resistant MFA is the real control against credential theft
This post was modified 4 days ago by NHI Mgmt Group