Topic starter
07/06/2026 8:11 pm
Identity assurance now fails at the session boundary, not the password boundary: Vishing succeeds because organisations still reason about authentication as a single event that ends at MFA completion. The article shows that the attack target is the bearer session that follows, which can be captured and replayed without the user ever failing the login step. Practitioners should therefore treat authentication success as only one control point in a larger access chain.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: Should teams prioritise phishing-resistant authentication or help desk hardening first?
A: Prioritise the path that is most exposed in your environment, but in practice the two controls are linked. If recovery workflows can be socially engineered, strong authentication alone will not hold. If sessions can be replayed after login, help desk hardening only reduces one entry path. Teams should address both, starting with the highest-risk identities and privileged workflows.
👉 Read our full editorial: Vishing-driven MFA bypass exposes the weak point in identity assurance
07/06/2026 10:00 pm
MFA does not fail first. Recovery trust does. The control weakness in vishing-driven account takeovers is not the factor itself, but the reset and recovery path that can be socially engineered into issuing a legitimate session. This is an identity governance failure because the environment treats the request channel as authoritative without proving who is on the other end. Practitioners need to treat recovery as part of the authentication surface, not as an administrative afterthought.
A question worth separating out:
Q: How should organisations compare MFA factors with recovery controls for account security?
A: MFA factors protect the login step, but recovery controls govern who can obtain a new trust anchor when the original one is lost or reset. In vishing campaigns, recovery is often the weaker control. Organisations should judge the full identity workflow, not just the presence of a second factor at sign-in.
👉 Read our full editorial: NYDFS vishing attacks expose the limits of MFA on paper