Topic starter
12/06/2026 10:10 pm
TL;DR: Identity-based cyberattacks are now the top global cybercrime attack vector, according to Axiad, with IBM cited in the article reporting a 71% rise in attacks using valid login credentials, while recent Snowflake-linked breaches showed how stolen credentials and weak MFA coverage can cascade into large-scale data loss. Conventional MFA is not enough when phishing and human bypass paths remain open.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Identity Gaps: The Need to Use Both x.509 & FIDO”.
By the numbers:
- IBM reported a 71% rise in attacks using valid login credentials.
Key questions
Q: How should security teams respond when attackers manipulate MFA in a cloud account takeover?
A: Security teams should treat MFA manipulation as a post compromise persistence tactic, not just an authentication issue.
Q: When should organisations prioritise x.509 certificates over passkeys for authentication?
A: Use x.509 certificates when you need broad enterprise coverage across managed devices, legacy applications, and workflows where passkeys are not yet consistently supported.
Q: What are the signs that cloud authentication is still too easy to phish?
A: Look for inconsistent MFA enforcement, exceptions on high-value accounts, user-approved push flows, legacy credential paths, and applications that accept weaker login methods alongside stronger ones.
Practitioner guidance
- Enforce phishing-resistant authentication for cloud admin and data-access accounts Prioritise certificate-based or passkey-based authentication on the accounts that can reach high-value cloud data, then remove fallback paths that still accept weaker factors.
- Inventory cloud accounts that still allow bypassable MFA Identify demo accounts, legacy logins, and exceptions where users can satisfy MFA through weaker or user-mediated methods, then classify those paths by data access scope.
- Separate broad cloud access from low-assurance identities Reduce the reach of former employee, contractor, and shared service access so that a single compromised credential cannot expose large datasets or tenant-wide resources.
Bottom line: Conventional MFA can reduce risk, but it does not eliminate phishing, bypass, or inconsistent enforcement across cloud access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:45 am
Phishing-resistant authentication is now a cloud governance requirement, not an advanced option: the article shows that conventional MFA still leaves exploitable human and process gaps in cloud access. When attackers can phish, bypass, or inherit weakly enforced factors, the control exists on paper but not in the access path. For identity programmes, that means authentication assurance must be measured by resistance to real attack paths, not by checkbox deployment.
A question worth separating out:
Q: What is the difference between certificate-based authentication and FIDO in practice?
A: Certificate-based authentication is strongest where device-bound trust and managed issuance are needed, while FIDO is often better where supported applications and user experience matter most. Many enterprises need both. The decision is less about which method is better overall and more about which one fits the access path, platform, and assurance requirement.
👉 Read our full editorial: Identity gaps in cloud auth show why phishing-resistant MFA matters
This post was modified 6 days ago by NHI Mgmt Group