A security researcher has recently disclosed flaws affecting Microsoft's passkey implementations across Entra ID and Windows 11. If successfully exploited, these weaknesses could have allowed attackers to gain unauthorised access to accounts using techniques traditionally associated with password-based attacks. Further technical details are expected to be presented at the upcoming Black Hat USA 2026 conference. While this may seem concerning, phishing-resistant authenticatio

Microsoft has announced a major shift towards phishing-resistant authentication, with native SMS and voice authentication being retired from Microsoft Entra ID on 1 February 2027. This reflects the industry's move towards stronger authentication methods that are more resistant to phishing, credential theft, and social engineering. For organisations still relying on SMS and voice-based authentication, now is the time to start planning your transition: Identify users still usi

Despite widespread Multi-Factor Authentication (MFA) adoption, identity-based attacks continue to succeed. The reason is that many authentication methods still rely on mechanisms attackers can bypass. Phishing-resistant authentication addresses this and should now be a top priority for organisations. Quick Takeaways Authentication remains a primary attack path: Attackers target passwords, login prompts, and active sessions because they provide a direct route into business sy