Topic starter
12/06/2026 10:05 pm
TL;DR: Phishing-resistant MFA is presented as a practical response to rising phishing volume, password weakness, and credential reuse, with Axiad arguing that stronger authentication reduces breach likelihood, protects revenue, and improves user experience. The deeper point is that identity programmes can no longer treat passwords as a tolerable control plane for access.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “7 Reasons Why Phishing-Resistant MFA Should Be Your Goal”.
By the numbers:
- In 2018, there were over 1.3 billion phishing attempts, and that number is expected to grow to over 10 billion by 2022.
Key questions
Q: How should security teams reduce phishing risk in MFA without creating more user friction?
A: Use phishing-resistant authentication for the highest-risk access first, then phase out phishable factors such as SMS, email links, and push approvals.
Q: Why do passwords and basic MFA still leave organisations open to account takeover?
A: Because they verify a secret or device, not the trustworthiness of the enrolled identity.
Q: What are the signs that an insurer's authentication approach is too easy to phish?
A: Common warning signs include reliance on SMS, OTP, or push approvals for remote workers, partners, contractors, and privileged accounts.
Practitioner guidance
- Prioritise phishing-resistant authentication for high-value access Move the most sensitive workforce, admin, and remote access flows onto methods that resist phishing, replay, and credential capture.
- Eliminate password-only login paths Inventory remaining password-based sign-ins across apps, VPNs, SaaS, and legacy services, then replace them with stronger MFA or passwordless options where feasible.
- Reduce credential reuse and sharing pressure Review workflows where employees share passwords or hand over access to get work done, then redesign those processes so the user does not need to disclose credentials to complete the task.
Bottom line: Phishing-resistant MFA is a response to a basic identity weakness: credentials that users can be tricked into giving away remain easy to exploit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:36 am
Phishing-resistant MFA is now a baseline control, not an advanced option. The article reflects a wider identity reality: if authentication still depends on secrets that users can type, share, or be tricked into revealing, the programme is exposed by design. The practical shift for identity governance is to treat phishing resilience as the minimum acceptable property of interactive access, not a premium enhancement.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What should teams do when phishing-resistant MFA is in place but fraud still occurs?
A: Teams should inspect the identity journey around the MFA control, especially recovery, enrolment, help desk intervention, and account takeover escalation. Fraud after strong MFA often means the attacker bypassed the login control entirely. The right response is to treat the incident as a lifecycle failure, not just an MFA failure.
👉 Read our full editorial: Phishing-resistant MFA is now the baseline for identity security
This post was modified 6 days ago by NHI Mgmt Group