Cisco Duo
MFA and device trust, with support for passkeys and security keys.
Access Control
Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
Addresses 239 stories in our coverage in the last 90 days 4 products that provide it
What it is
Multi-factor authentication with FIDO2 security keys or passkeys, where the login is cryptographically tied to the real website. Unlike SMS codes and push approvals, it cannot be relayed through a fake login page or approved by a tired user.
How to value it
Most breaches still start with a valid login: a phished password, one reused from an old leak, or an MFA prompt approved by mistake. Phishing-resistant MFA removes that whole class of attack for the systems it covers, which is why regulators and cyber insurers increasingly ask for it. The cost is mostly rollout effort and hardware keys for staff who cannot use passkeys. Set it against the cost of one compromised email or admin account.
Questions to ask a vendor
- 1Does it support FIDO2 and passkeys, and can we enforce them and switch off SMS and push fallbacks?
- 2How are lost keys and new phones handled without the help desk becoming the new weak spot?
- 3Which of our systems can it cover today: email, VPN, SaaS apps, older applications?
- 4Can we report on who still uses weaker methods?
For your risk register
- Risk
- Account takeover through phished or reused credentials.
- Control
- Phishing-resistant MFA (FIDO2 or passkeys) on email, remote access and admin accounts.
- Owner
- Identity and access lead.
- Measure
- Share of users and admin accounts on phishing-resistant methods.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Microsoft Entra ID
Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.
Okta Workforce Identity
Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.
YubiKey
Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.
Recent stories it addresses
628 stories in total- 17 Oct 2026Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers compromised Microsoft 365 tenants via ConnectWise's Cloud Backup service.
- 16 Oct 2026UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
APT campaign uses fake event invites to target Taiwan research affiliates with Google AitM phishing.
- 16 Oct 2026Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials
US election officials warned of sophisticated phishing and smishing attacks targeting 2026 midterms.
- 15 Oct 2026Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages
Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI, and Iron Man services.
- 14 Oct 2026Global takedown hits network behind 1 billion phishing messages
Global takedown disrupts cybercrime network behind 1 billion phishing messages.
- 14 Oct 2026Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft and partners disrupt Chinese-language phishing kit ecosystem, stopping over 1 billion messages.
- 14 Oct 2026Hirudo Android malware replaces banking apps to evade security checks
Hirudo Android malware replaces banking apps with modified versions to steal credentials.
- 13 Oct 2026AI Scams Target Crypto Users, Not Protocols, and Wallet Security Is Catching Up
AI-powered scams targeting crypto users surged in 2025, leading to billions in losses.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.