Today’s #1 Cybersecurity Control: Phishing-Resistant Authentication

Despite widespread Multi-Factor Authentication (MFA) adoption, identity-based attacks continue to succeed. The reason is that many authentication methods still rely on mechanisms attackers can bypass. Phishing-resistant authentication addresses this and should now be a top priority for organisations.

Quick Takeaways

• Authentication remains a primary attack path: Attackers target passwords, login prompts, and active sessions because they provide a direct route into business systems.

• Attackers have adapted to MFA: Many common MFA methods can still be phished, intercepted, or bypassed.

• Phishing-resistant authentication should be prioritised: It goes beyond traditional MFA by reducing reliance on shared secrets and preventing authentication on fake services.

  
  

The Authentication Challenge

Organisations now have more authentication options than ever: passwords, Multi-Factor Authentication (MFA), password managers, passwordless sign-in, passkeys, certificate-based authentication, and more.

While this variety reflects incremental improvements in authentication over time, it also creates modern-day uncertainty. With limited IT resources and increasing demand, organisations are often unsure which methods provide meaningful security gains and where to focus their efforts.

While every organisation will have its own considerations, the direction is clear:

Phishing-resistant authentication should be the priority.

Why Identity Deserves Priority

In a modern Zero Trust digital world, identity is one of the most critical security domains to protect. As organisations adopt cloud services, hosted applications, and remote work, reliance on the traditional network perimeter has diminished.

Identity has become the primary control plane for accessing systems and data.

This does not diminish the importance of other domains, such as endpoint or application security. Rather, it reflects a practical reality:

Identity is now the front door—and attackers know it.

Why MFA Wasn’t Enough

Authentication security has evolved through several stages:

• Passwords

• Stronger password policies

• Password managers

• Multi-Factor Authentication (MFA)

• Passwordless sign-in

  
  

While each step improved security, attackers ultimately adapted at every stage.

These vulnerabilities largely stem from a shared underlying issue: many authentication methods still rely on shared secrets (such as one-time passcodes) or depend on user judgement and awareness.

These weaknesses are actively exploited through:

• Phishing and social engineering

• Adversary-in-the-middle (AiTM) attacks

• MFA fatigue attacks

• Session hijacking and token theft

  
  

What Makes Phishing-Resistant Authentication Different

Phishing-resistant authentication fundamentally changes how authentication works. It is not about adding more steps—it is about removing the conditions that make phishing attacks successful.

Key characteristics include:

• Eliminates or reduces shared secrets - Uses cryptographic authentication instead of passwords or one-time codes.

• Binds authentication to the legitimate service - Authentication only succeeds when interacting with the genuine application, device, or domain. Users are no longer expected to detect subtle phishing attempts or fraudulent prompts in real time.

  
  

In practice, this means authentication will not succeed on a fake site, even if a user is tricked into visiting one.

This removes one of the weakest links in security: reliance on human judgement under pressure.

Authentication Strength at a Glance

Level	Authentication Method	Examples	What It Means
🔴 Poor	Password only	A combination of letters, numbers, and special characters	High risk. Passwords can be guessed, reused, stolen, or tricked out of users through fake websites or emails.
🟠 Fair	Password + basic MFA	SMS codes, phone calls, email codes	Safer than a password alone, but attackers can still trick users into sharing codes or intercept them.
🔵 Stronger	App-based MFA or passwordless	Authenticator apps, push notifications, security tokens	Stronger protection, but users can still be tricked into approving logins, or attackers can take over sessions after login.
🟢 Best	Phishing-resistant authentication	Security keys, passkeys, Windows Hello, certificates	Strongest protection. Only works with the real website or app, so fake login pages won’t work. Extra protections are still needed to secure active sessions after login.

Where to Start

Adopting phishing-resistant authentication comes with real-world constraints such as legacy applications, budget considerations and user readiness. These challenges do not change the strategic direction however; they simply require a deliberate rollout.

The most effective approach is progressive and risk-based.

Start with users and systems where a security compromise would have the greatest impact:

• Executive leadership

• IT administrators and privileged accounts

• Finance, payroll, and payment systems

• Remote access and cloud administration portals

• High-value applications containing sensitive data

  
  

For example, many organisations begin by enforcing phishing-resistant authentication (such as FIDO2 security keys or passkeys) for privileged accounts, while maintaining existing MFA for lower-risk users during the transition.

The goal is not perfection on day one—it is measurable risk reduction over time.

Final Takeaway

No single control can guarantee security. Effective cybersecurity requires layered defence across people, processes, and multiple technology domains, such as identity, endpoint, and network security.

However, in today’s threat landscape, identity is a critical control point, and authentication remains one of the most heavily targeted entry paths.

Prioritising phishing-resistant authentication is one of the most decisive steps an organisation can take today to secure its digital estate. It reduces reliance on shared secrets, helps neutralise lookalike login attacks, and lessens dependence on user judgement.

Modern identity security is no longer about improving on shared secrets — it is about removing them altogether.