Topic starter
26/08/2026 11:51 am
TL;DR: The DoW CIO’s new “Brilliant at the Basics” guidance ranks phishing-resistant MFA as the top IT cybersecurity practice for small, mid-sized, and non-traditional Defense Industrial Base suppliers, signalling that SMS codes and push-based MFA no longer meet the modern trust bar, according to Yubico. Legacy MFA assumes attackers cannot intercept or socially engineer the second factor, but that assumption breaks under phishing, SIM-swapping, and MFA fatigue.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “The Defense Industrial Base Has a New #1 Cybersecurity Priority: Phishing-Resistant MFA”.
Key questions
Q: What breaks when organisations rely on SMS or email MFA for sensitive access?
A: The control breaks when the second factor can be intercepted, relayed, or socially engineered.
Q: When does phishing-resistant MFA create more value than traditional MFA?
A: It creates the most value where credential theft, phishing, and session hijacking are recurring threats, especially for customer login, employee access, and privileged activity.
Q: How should DIB suppliers decide whether MFA is strong enough?
A: They should ask whether the factor can be replayed, intercepted, or socially engineered outside the legitimate session.
Practitioner guidance
- Replace legacy MFA on sensitive access paths Remove SMS and push-based approval methods from privileged, supplier, and government-facing accounts where phishing resistance is required.
- Adopt device-bound authenticators for high-trust access Use FIDO2/WebAuthn security keys or PIV/CAC credentials for systems that rely on stronger proof of user presence and origin binding.
- Separate IT and OT identity controls Do not assume the corporate authentication stack is sufficient for operational technology, where access paths and consequences differ.
Bottom line: Phishing-resistant MFA is being treated as the minimum defensible access control for DIB suppliers, which shifts the conversation from MFA coverage to MFA quality.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Phishing-resistant MFA is now an access governance baseline, not an advanced option: Once a government customer names it the top practice, the decision space changes for every supplier that still treats SMS or push approvals as acceptable. The issue is not whether MFA exists, but whether the factor can survive phishing, interception, and approval abuse. Practitioners should read this as a control-class shift, not a product feature debate.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations prioritise phishing-resistant MFA over other identity projects?
A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.
👉 Read our full editorial: Phishing-resistant MFA is now the DIB baseline, not a nice-to-have