Insights · Field note · Security assurance and compliance
MFA and phishing-resistant authentication: planning the move
Conventional MFA is the floor. Attackers clear it routinely. Moving to credentials that cannot be relayed is a sequence, not a switch.
Conventional multi-factor authentication, codes and push notifications, stops attackers who have only a password and fails against real-time phishing proxies and push fatigue, both now routine. Phishing-resistant authentication, FIDO2 security keys and platform passkeys, binds the credential to the genuine site so it cannot be entered elsewhere or relayed. NIST SP 800-63B and CISA describe the distinction. Planning the move means starting with the accounts where compromise is most consequential, confirming application support, choosing keys or passkeys per population, and keeping conventional MFA only where nothing better is yet possible.
In detail
What the evidence shows.
Why the move is necessary
Proxy phishing kits capture the code or the session token in real time. Push notifications are approved by tired users. Both defeat conventional MFA without touching the password. Phishing-resistant methods are immune to relay because the credential is cryptographically tied to the legitimate origin.
Sequence
Administrators and privileged accounts first. Then finance, executives and anyone who can move money or data. Then remote access and email for everyone. Then the remaining workforce as applications allow. Each population gets the method that fits: hardware keys where devices are shared or sensitive, platform passkeys where managed devices support them.
Obstacles and how they are handled
Legacy applications that cannot use modern authentication are placed behind an access layer that can. Shared accounts are eliminated or vaulted. Users without compatible devices get keys. Recovery processes are redesigned, because account recovery is where attackers go next. Each exception is recorded with an expiry rather than accepted silently.
Evidence
A coverage report by population and method, dated, is what insurers and customers increasingly ask for, and they increasingly distinguish phishing-resistant methods. See MFA and phishing-resistant authentication planning and MFA versus phishing-resistant authentication.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days