[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:phishing-resistant-mfa":3},{"control":4,"products":25,"stories":58,"lessons":102,"related":127,"compare":148},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.","Multi-factor authentication with FIDO2 security keys or passkeys, where the login is cryptographically tied to the real website. Unlike SMS codes and push approvals, it cannot be relayed through a fake login page or approved by a tired user.","Most breaches still start with a valid login: a phished password, one reused from an old leak, or an MFA prompt approved by mistake. Phishing-resistant MFA removes that whole class of attack for the systems it covers, which is why regulators and cyber insurers increasingly ask for it. The cost is mostly rollout effort and hardware keys for staff who cannot use passkeys. Set it against the cost of one compromised email or admin account.",[11,12,13,14],"Does it support FIDO2 and passkeys, and can we enforce them and switch off SMS and push fallbacks?","How are lost keys and new phones handled without the help desk becoming the new weak spot?","Which of our systems can it cover today: email, VPN, SaaS apps, older applications?","Can we report on who still uses weaker methods?","Risk: account takeover through phished or reused credentials. Control: phishing-resistant MFA (FIDO2 or passkeys) on email, remote access and admin accounts. Owner: identity and access lead. Measure: share of users and admin accounts on phishing-resistant methods.",[17,18,19,20],"NIS2 Art. 21(2)(j): multi-factor authentication","DORA Art. 9: strong authentication mechanisms","CIS Controls 6.3 to 6.5: MFA for external apps, remote access and admin access","ISO\u002FIEC 27001:2022 A.8.5: secure authentication",{"name":22,"slug":23},"Access Control","access-control","2026-10-16T12:47:53.910602+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"total":59,"last_days":60,"recent":61},628,239,[62,67,72,77,82,87,92,97],{"slug":63,"title":64,"published_at":65,"brief":66},"hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack-622bd9","Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack","2026-10-17T15:18:51+00:00","Hackers compromised Microsoft 365 tenants via ConnectWise's Cloud Backup service.",{"slug":68,"title":69,"published_at":70,"brief":71},"uat-11985-uses-fake-event-invites-to-target-taiwan-research-affiliates-with-goog-23e482","UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing","2026-10-16T16:16:44+00:00","APT campaign uses fake event invites to target Taiwan research affiliates with Google AitM phishing.",{"slug":73,"title":74,"published_at":75,"brief":76},"cyber-threat-actors-use-a-variety-of-techniques-to-target-election-and-campaign--4e525e","Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials","2026-10-16T12:00:00+00:00","US election officials warned of sophisticated phishing and smishing attacks targeting 2026 midterms.",{"slug":78,"title":79,"published_at":80,"brief":81},"microsoft-seizes-yam-store-and-phishing-kit-domains-linked-to-1b-malicious-messa-e0d594","Microsoft Seizes YAM Store and Phishing Kit Domains Linked to 1B Malicious Messages","2026-10-15T10:34:53+00:00","Microsoft and Health-ISAC seize domains linked to YAM Store, CoGUI, and Iron Man services.",{"slug":83,"title":84,"published_at":85,"brief":86},"global-takedown-hits-network-behind-1-billion-phishing-messages-d21e2d","Global takedown hits network behind 1 billion phishing messages","2026-10-14T13:12:52+00:00","Global takedown disrupts cybercrime network behind 1 billion phishing messages.",{"slug":88,"title":89,"published_at":90,"brief":91},"microsoft-and-partners-disrupt-vast-chinese-language-phishing-kit-ecosystem-987ce0","Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem","2026-10-14T13:00:00+00:00","Microsoft and partners disrupt Chinese-language phishing kit ecosystem, stopping over 1 billion messages.",{"slug":93,"title":94,"published_at":95,"brief":96},"hirudo-android-malware-replaces-banking-apps-to-evade-security-checks-7a5799","Hirudo Android malware replaces banking apps to evade security checks","2026-10-14T11:41:20+00:00","Hirudo Android malware replaces banking apps with modified versions to steal credentials.",{"slug":98,"title":99,"published_at":100,"brief":101},"ai-scams-target-crypto-users-not-protocols-and-wallet-security-is-catching-up-dfca2f","AI Scams Target Crypto Users, Not Protocols, and Wallet Security Is Catching Up","2026-10-13T21:29:57+00:00","AI-powered scams targeting crypto users surged in 2025, leading to billions in losses.",[103,107,111,115,119,123],{"slug":104,"title":105,"published_at":106},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":108,"title":109,"published_at":110},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":112,"title":113,"published_at":114},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":116,"title":117,"published_at":118},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":120,"title":121,"published_at":122},"hirudo-malware-swaps-banking-apps-to-steal-credentials-and-bypass-security","Hirudo Malware Swaps Banking Apps to Steal Credentials and Bypass Security","2026-10-14T13:20:20.786+00:00",{"slug":124,"title":125,"published_at":126},"ai-powered-crypto-impersonation-scams-surge-1400-in-2025","AI-Powered Crypto Impersonation Scams Surge 1,400% in 2025","2026-10-13T22:20:45.127+00:00",[128,132,136,140,144],{"slug":129,"name":130,"problem":131},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":133,"name":134,"problem":135},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":137,"name":138,"problem":139},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":141,"name":142,"problem":143},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":145,"name":146,"problem":147},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"yubico\u002Fyubikey":149,"microsoft\u002Fentra-id":163,"okta\u002Fworkforce-identity":182,"cisco\u002Fduo":200},{"hq_country":150,"also_provides":151,"reviews":152,"affected":162,"reported":162},"SE",[],[153,156,159],{"label":154,"url":155},"Gartner Peer Insights: Yubico YubiKey user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fyubico-yubikey",{"label":157,"url":158},"PeerSpot: Yubico YubiKey user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fyubico-yubikey-reviews",{"label":160,"url":161},"NIST FIPS 140-3 certificate #5291: YubiKey 5 Cryptographic Module","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fcryptographic-module-validation-program\u002Fcertificate\u002F5291",0,{"hq_country":164,"also_provides":165,"reviews":167,"affected":180,"reported":181},"US",[166],{"slug":137,"name":138},[168,171,174,177],{"label":169,"url":170},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":172,"url":173},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":175,"url":176},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",{"label":178,"url":179},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",244,105,{"hq_country":164,"also_provides":183,"reviews":185,"affected":198,"reported":199},[184],{"slug":137,"name":138},[186,189,192,195],{"label":187,"url":188},"TechRadar: Okta review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fokta-review",{"label":190,"url":191},"PeerSpot: Okta Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fokta-platform-reviews",{"label":193,"url":194},"Gartner Peer Insights: Okta Workforce Identity user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fokta-workforce-identity",{"label":196,"url":197},"CSO Online: Okta bets on identity to control AI agents, but is identity enough? (2026)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4225230\u002Fokta-bets-on-identity-to-control-ai-agents-but-is-identity-alone-enough.html",1,3,{"hq_country":164,"also_provides":201,"reviews":202,"affected":215,"reported":216},[],[203,206,209,212],{"label":204,"url":205},"CyberRatings 2025 Q3 SSE Report: Cisco","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q3-sse-report-cisco\u002F",{"label":207,"url":208},"PeerSpot: Cisco Secure Firewall user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcisco-secure-firewall-reviews",{"label":210,"url":211},"Gartner Peer Insights: Cisco Secure Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcisco-secure-firewall",{"label":213,"url":214},"CyberRatings 2025 Q4 Enterprise Firewall Report: Cisco","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-cisco\u002F",50,31]