When attackers can’t phish a passwordless login or bypass a strong authenticator, they pivot to the most human system in identity: the helpdesk. Helpdesk-assisted recovery exists for a good reason. Real employees lose devices, travel, change roles, and get locked out at the worst times.
Authenticator apps are a popular MFA choice because they feel like a clean upgrade from passwords and SMS codes. They are inexpensive, easy to roll out, and familiar to users. But in many enterprise environments, authenticator apps create an underappreciated risk: they concentrate access, recovery,
Corporate authentication has changed faster than most policies. For years, “strong security” meant a password plus something else: an SMS code, an authenticator app, or a push notification. That baseline helped, but attackers adapted. Real-time phishing, adversary-in-the-middle (AiTM) tooling, SIM swapping, and push-fatigue attacks have
Key insights from our Post-Quantum Security Talks & Drinks in Barcelona Quantum computing is moving rapidly from research labs to strategic planning discussions in cybersecurity. During our Post-Quantum Security Talks & Drinks event in Barcelona, security professionals gathered to discuss what the transition to the
Account recovery is where strong authentication programs quietly fail. Teams harden login with passwordless methods, but recovery remains a soft target: reset links, inbox compromise, helpdesk social engineering, and inconsistent proofing. Resilient recovery has two goals that often feel in tension: You can achieve both,
Most authentication programs are designed for the “happy path”: a normal user, a normal device, and a normal day. Real enterprises run on abnormal days. Devices are lost. Users change roles. Contractors churn. Networks fail. Incidents happen at the worst possible time. Resilient authentication is
Mobile World Congress (MWC) 2026 is back in Barcelona from 2–5 March 2026, celebrating its 20th anniversary as the world’s leading connectivity and tech gathering. This makes Barcelona the ultimate destination for innovation, networking, and cutting-edge thought leadership across sectors like AI, mobile, cloud, and
Phishing and credential theft are not “password problems”. They are workflow problems. Attackers succeed because authentication flows still depend on reusable secrets, human confusion, and recovery paths that can be manipulated. Passwordless authentication changes this equation by removing the password from the user flow and
Regulated environments do not adopt authentication methods because they are fashionable. They adopt them because they need controls that are defensible. That means two things at the same time: Passwordless authentication can deliver both, but only if it is designed as a program with auditability,
Passwordless authentication is often sold as a clean replacement: remove passwords, add passkeys or security keys, and move on. In enterprise reality, most failures happen elsewhere: in enrollment, policy exceptions, shared-device workflows, and recovery. This article covers the mistakes that repeatedly undermine passwordless programs and
