Glossary · P
Phishing-resistant authentication
Phishing-resistant authentication uses credentials, such as FIDO2 security keys and passkeys, that are bound to the legitimate site and cannot be entered on a fake page or relayed through a proxy.
Extended definition
In more detail.
Attackers now capture codes and sessions in real time and exploit push fatigue, defeating conventional MFA. Phishing-resistant methods close that path because the credential only works with the genuine service. Federal guidance directs agencies and contractors toward them, insurers increasingly distinguish them, and they are often easier for users than codes. Rollout begins with administrators, finance, executives and remote access.
In our work
Where it appears.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days