Does this replace our existing SSO and IdP, or sit alongside it?

It sits alongside your existing MFA — not instead of it. Policy routes each worker to the right method. Your desk workers keep push notifications. Your factory floor, field staff, and restricted-environment workers get the card. Both are governed. Both are covered. Zero rip-and-replace. Deviceless MFA sits alongside device-bound MFA and closes the workers it can't reach.

How do we actually deploy Deviceless MFA to 50,000 users?

A single IGA workflow bulk-provisions cards for every worker simultaneously. No hardware procurement cycle. No app install. No per-worker IT session. Workers receive a card — same delivery channel as an ID badge. On-site, mailed, or kiosk-printed on demand. Deployment takes under an hour.

How does this integrate with SCIM and our IGA platform?

Card provisioning is driven by the same SCIM events that create a worker's directory identity. Issuance, re-issuance, and revocation flow through your existing IGA workflow — the same governance that approves access requests approves cards. Audit logs write back to the same pane of glass.

What happens during an active cyberattack when identity systems are down?

That is exactly what this was built for. Nothing runs at authentication time — no server call, no network dependency, no identity provider. The card resolves locally. When everything else fails, the card still works. Your service desk can still verify users. Business operations can continue. That's what Deviceless MFA is built to do.

How is Deviceless MFA actually cheaper than our current MFA stack?

No per-seat app license. No hardware token procurement. No device refresh cycle. A printed card costs cents per worker, and re-issuance is a reprint — not a procurement cycle.

What's the real financial upside when identity fails during a breach?

Extended identity downtime during an intrusion translates into material lost revenue for Fortune 500 operations. Deviceless MFA turns that outage into a day. The board-level math favors having the control in production before the event — not after.

Does the card add hidden cost — reprints, storage, logistics?

Cards are printed on demand through the same logistics that deliver ID badges. Storage is the IGA record — not physical stock. Reprints are a self-service workflow. The hidden cost is the one you're already paying on app licenses and lockout support tickets.

How do I explain Deviceless MFA to the board without getting into authentication acronyms?

Boards don't ask which authentication product you use — they ask how long the business is exposed when identity fails. Deviceless MFA is the answer to that question. When device-bound MFA goes down, the Identity Challenge Card keeps every worker verified. It's the continuity story that turns a front-page headline into a footnote in the annual report.

What is my SEC 8-K disclosure story if identity systems fail during a breach?

Under the SEC's four-day cyber disclosure rule, identity failure is a material event. Deviceless MFA gives CEOs a defensible answer to the first question on every 8-K filing: what continuity plan did you have for when device-bound MFA failed? The Identity Challenge Card is that plan — in production, audited, and documented.

How does this meet CMMC, HIPAA, PCI-DSS, and GDPR requirements?

Every major compliance framework requires authentication that works for every worker in every environment. Device-dependent MFA cannot deliver that — your exceptions are documented compliance risk. A governed Identity Challenge Card closes every exemption with immutable audit logs, policy-enforced expiration, and identity-verified re-enrollment. No personal data is processed by the auth mechanism — zero GDPR exposure.

What does the service desk actually do when someone loses a card?

Re-issue through the governed IGA workflow. Identity is re-verified through the same controls that approved the original issuance — no social-engineering shortcut, no device pairing session. Access is restored in seconds.

How does the worker get a new card without coming to the desk?

Three options: on-site kiosk print, mailed card, or supervisor-approved local reprint. Each flow is logged. Each flow is governed. None of them require a phone call to the help desk.

What happens when the whole IdP is down and everyone is locked out?

The card resolves locally. The service desk runs the challenge against the printed grid — no IdP call, no network dependency. Workers are re-authenticated while the IdP recovers.

Is Deviceless MFA a real category or a rebrand of hardware tokens?

Hardware tokens are devices — they have batteries, firmware, serial numbers, and supply chains. Deviceless MFA has none of those. A printed grid of word pairs resolves challenges locally with no power, no network, no provisioning cycle. The architecture is fundamentally different from FIDO2 security keys, TOTP apps, and push-based authenticators — which is why incumbents cannot replicate it by shipping an update.

What's the TAM and why can't incumbents ship it in a feature release?

80% of the global workforce is deskless — that's the addressable gap every device-bound MFA vendor leaves uncovered. Incumbents can't ship Deviceless MFA without redesigning their architecture. The category is defensible by construction.

How does this compare to FIDO2, TOTP, and push authenticators?

FIDO2 needs a hardware key. TOTP needs an app with a shared secret. Push needs a working network and an attention budget. Deviceless MFA needs none of those — and burns each coordinate after a single use, so a captured value is already dead.

Human Verification

Deviceless MFA

Identity Challenge Card

Q: What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?

Deviceless MFA is multi-factor authentication that works without a phone, an app, a hardware token, or a network connection. The Identity Challenge Card is the first production implementation: a printed grid of word pairs that a user looks up during login. When Stryker's device-bound MFA went down during the Iranian Handala intrusion, Deviceless MFA is the category that would have kept workforce verification running — under an hour to deploy, every worker covered, zero device dependency.

Q: Is a printed card actually secure? A lost card means a compromised credential.

The card contains no personal data and no identity information. Without the PIN it is useless. A lost card is less dangerous than a lost phone — you can't SIM-swap paper. The card is revoked in seconds and replaced the same day. Cyber attackers cannot compromise paper. That is an architectural truth, not a tagline.

Q: Can push bombing or replay attacks work against this?

No. There are no push notifications — so push fatigue attacks have no surface. Each coordinate value is one-time — used values are permanently burned and never reused. Replay attacks are structurally impossible. Air-gapped Deviceless MFA means no network attack surface exists.

Prevent Hacker Attacks

The Identity Challenge Card is a printed grid of word pairs — no phone, no app, no network. A worker reads back a one-time coordinate and their identity resolves locally: at the service desk, at login, and at a password reset.

Every worker, every environment
Deployed in under an hour
No MDM, no app, no hardware
Multilingual — RTL and CJK included
Easy re-enrollment — no device pairing

See It Try It

--:--

Read transcript

The Identity Challenge Card, from Avatier. Deviceless MFA for every worker.

Most MFA assumes a trusted device is there when someone signs in. For most of the workforce, it isn't. Eighty percent of workers are deskless. They're on factory floors, in hospitals and out in the field, and they rarely carry a work phone. So organizations write MFA exceptions for them, and those exceptions are the first thing attackers map.

The Identity Challenge Card closes that gap. It's a printed grid of word pairs. No phone, no app, no network. The system asks for a coordinate, the worker reads the matching word off the card and adds a private PIN, and their directory identity is checked automatically. Each value works only once, so it can't be replayed. And it all resolves locally, even when devices, networks or the identity provider are down.

One card covers three moments. At the service desk, the agent verifies the caller, not the caller's phone. At login, it works with or without a password, including on shared workstations and virtual desktops. And at a password reset, a locked-out worker proves who they are and resets it themselves, with no help desk call.

The card can also live in Apple Wallet, Google Wallet or Samsung Wallet, as a backup alongside the printed card.

Cards are issued through the identity governance workflow you already run. Every challenge and re-issue is logged, and the whole workforce can be up and running in under an hour.

Try the live card on this page, or book a meeting with the team.

The Identity Challenge Card as a printed badge on an Avatier lanyard: a five-by-five grid of word pairs in columns A to E and rows 1 to 5, above step-by-step instructions for finding a coordinate and reading back the top or bottom word.

Protecting the world’s workforce since 1997 • Over 15 Million Licenses Sold

SOC 2 Type 2 — Avatier compliance attestation

ISO/IEC 27001 — Avatier compliance attestation

PCI DSS v4.0.1 — Avatier compliance attestation

NIST 800 Series — Avatier compliance attestation

NIST Cybersecurity Framework — Avatier compliance attestation

CISA Secure-by-Design — Avatier compliance attestation

CSA STAR AI Level 1 — Avatier compliance attestation

CSA AI Trustworthy Pledge — Avatier compliance attestation

Use Cases

Three Use Cases, One Printed Card

The same card covers the three moments a credential gets proven, replaced, or recovered — at the service desk, at login, and at reset. Play any explainer and follow the transcript as it speaks.

Use Cases 01
TranscriptTap a word to play from there
A caller says they're locked out and need their access back.
The agent has to decide: is this really them?
Texting a code to the caller's phone assumes the phone is theirs, not a device the attacker may already control.
The Identity Challenge Card, from Avatier, is deviceless MFA on a printed card.
The agent names a coordinate.
The caller reads the matching word back off the card.
The desk checks the answer locally.
Each value works only once, so it can't be replayed.
Security questions can be researched.
What's on the card isn't online, or on a device.
It still works when the identity provider is down.
Built for service desk leaders, and for the security and IT leaders behind them.
Verify the human, not the device.
Try the live card at identitychallengecard.avatier.com
Verify the Human
Someone calls the service desk asking for their access back. The agent names a coordinate, the caller reads the answer off their printed card, and that value is spent — a live identity check that doesn't rely on a device the attacker may already control.
See it for the service desk
Use Cases 02
TranscriptTap a word to play from there
Same workstation, a different worker every shift.
The login has to know who's standing there.
Most MFA assumes a trusted device at sign-in.
On the line, there often isn't one, so those workers become exceptions.
The Identity Challenge Card, from Avatier, puts the factor on a printed card instead.
Here she signs in without a password.
A coordinate appears.
She reads the word off her card, adds her PIN, and her employee ID is checked automatically.
Same card on a virtual desktop.
Where the site keeps the password, the card answers the MFA challenge.
It sits alongside the MFA you already run, and policy routes each worker to the right method.
Built for shared workstations, frontline teams, and the IT and security leaders covering them.
Login, with or without a password.
Try the live card at identitychallengecard.avatier.com.
Login, With or Without a Password
The card is the factor either way. Use it passwordless on shared workstations and virtual desktops, or keep the password and let the card answer the MFA challenge — no phone required, no app required, no hardware token to enroll.
Compare to device MFA
Use Cases 03
TranscriptTap a word to play from there
Back from break, and locked out.
The phone that should prove it's you is dead, out of signal, or in a locker.
With device MFA, that turns into a help desk call.
With the Identity Challenge Card, from Avatier, he resets it himself.
The new password field stays locked.
A coordinate appears.
He reads the word off his printed card and adds his private PIN, and his employee ID is checked automatically.
Proof first.
Only then does the password change.
The phone never came into it, and there was no help desk call.
Every challenge and re-issue is logged in the identity governance you already run.
Built for workers who can't count on a phone, and for service desk leaders tired of the lockout queue.
Proof first, then the password.
Try the live card at identitychallengecard.avatier.com.
Self-Service Password Reset
A locked-out worker resolves it themselves. The card proves who they are before the password changes, so the reset needs no help desk call — and it still works when the phone is dead, out of signal, or in a locker.
Try the live card

Also Available

Identity Challenge Card for Mobile Wallets

Human verification in your pocket. Add the card to Apple Wallet, Google Wallet or Samsung Wallet for fast access and a secure backup identity, ready when standard MFA fails — alongside the printed card, not instead of it.

Wallet-ready access
Human verification
Backup MFA when it matters
Government ID verification (coming soon)

Bring identity backup to every employee.

The Identity Challenge Card shown three ways: as a wallet pass on an Android phone and on an iPhone, each displaying a five-by-five grid of word pairs with columns A to E and rows 1 to 5, the iPhone pass adding the account, domain, dates and a card ID QR code — and as a printed badge on an Avatier lanyard with its own word grid and step-by-step instructions.

The Device Dependency Problem

Device-Dependent MFA Can't Protect Workers Who Don't Have a Device

Every MFA product on the market assumes a trusted device is available at authentication time. That assumption is wrong for most of the workforce.

80% of the global workforce is deskless. Factory floors, hospitals, field service, retail, logistics, education, construction — the workers running the operation rarely carry a work phone, and the ones who do can't use it on the shop floor.

The result is a documented coverage gap. Organizations write MFA exceptions for the workers they can't reach. Those exceptions are the attack surface cyber adversaries map first.^1,2,3

SMS / voiceTOTP appsPush authenticatorsFIDO2 security keysHardware tokensBiometricsPasskeysSmartcardsNone are deviceless.

80 percent

80% of the global workforce is deskless

2.7 billion workers worldwide don't sit at a desk, don't carry a work phone, and can't install an authenticator app — and they're the workforce most organizations leave uncovered.

20 industries

Industries

5 to 88 percent

Device MFA reach

Retail57 companies

95% Deviceless coverage gap

Healthcare42 companies

95% Deviceless coverage gap

Transportation & Logistics31 companies

93% Deviceless coverage gap

Manufacturing48 companies

92% Deviceless coverage gap

Food & Beverage19 companies

90% Deviceless coverage gap

10% Device-covered workers

Construction14 companies

90% Deviceless coverage gap

10% Device-covered workers

Device-covered workers

Deviceless coverage gap

Deviceless MFA closes the red. Device-dependent MFA can't reach it without a phone, an app, a token, or a network.

For the CFO: every uncovered frontline worker is an uninsured breach vector — one stolen credential from a seven-figure incident, a denied cyber-policy claim, and an audit finding that pushes your next renewal. Deviceless MFA is how that math stops working against you.

Fifteen minutes. We'll map your coverage gap and what it's costing you today.

Sources

Fortune 500 workforce composition derived from 10-K filings, Bureau of Labor Statistics industry occupation mixes, and Gallup's State of the Global Workplace (2024). Deskless ratio per industry follows Emergence Capital's Deskless Workforce Report. Full methodology available on request.

[1] Enterprise VC research — State of Technology for Deskless Workers (2020)
[2] Global strategy consultancy — Making Work Work Better for Deskless Workers (Dec 2022)
[3] Industry analyst firm — 75% of new mobile initiatives target frontline workers
[4] Business publication — 2025 ranking of largest U.S. companies by revenue (June 2025)

Full Methodology Download PDF

Built for the Day Traditional MFA Fails

The Iranian Handala Stryker Attack Is Why Deviceless MFA Exists.

Handala is Iran-aligned. They don't want a ransom — they want you offline.

State-aligned wiper groups don't negotiate; they build payloads designed to keep your workforce locked out. Then the phone rings at your service desk. “This is John from Cardiology — I need my access back, now.” How does the tech on the line know it's actually John — and not the attacker who already owned John's phone?

The Identity Challenge Card verifies the human, not the hardware. Three factors on one air-gapped credential: the card (can't be cloned remotely), a PIN (never stored on a device), and an identity factor (verified at the point of use). Traditional MFA only proves the attacker hasn't rooted the device holding your token — an assumption that collapses in an Iranian-playbook incident before the first alert fires.

Service desk and IT operations use ICC as their live identity check. The agent asks for a specific coordinate; the caller reads the matching word pair off their printed card, and the desk resolves that answer against the grid locally — no IdP call, no network dependency. Now IT operations know they're who they claim to be, or they aren't. No social engineering. No deepfake voice that works. No password reset handed to the wrong person.

With Avatier ICC, you know every identity the moment a failure starts — workforce verified and operational in under an hour. No re-enrollment. No MDM rebuild. No help-desk queue full of callers you can't verify.

And what the card does today is just the start. Ask us where it goes next.

Click the Book Meeting button to schedule a quick fifteen minute call. We'll walk your team through the Iranian playbook on your stack — and show you what verified recovery looks like.

Book Meeting→View Press Release→Calculate Your Cyber Attack Cost→

The Difference

Device-Dependent MFA vs Deviceless Authentication

Device-Dependent MFA

Deviceless Authentication

Requires a phone, app, token, or hardware key

Works with a printed card — no device ever

Fails when devices, networks, or IdPs are down

Resolves locally during the outage

Push-bombing, SIM-swap, and replay are in-scope

One-time coordinates — replay is structurally impossible

Covers 20% of workforce; 80% is an exception list

Covers 100% of workers — every environment

Per-seat app licenses and hardware procurement

Printed once, reissued in seconds at cents per worker

Deployment measured in months per workforce segment

One IGA workflow — full deployment in under an hour

With this fallback identity layer, Stryker's rebuild would have been days, not weeks.

How It Works

Three Factors. Zero Device Dependency.

Deviceless MFA resolves three independent factors — all locally, all without a device, and all in under 10 seconds.

Challenge Card Factor

A printed grid of word pairs. At login, the system asks for a specific coordinate — the user reads the answer directly off the card. No network call. No device.

Private Knowledge Factor

A short PIN that only the user knows. Bound to the card via policy and verified in-memory so replay and brute-force have no surface.

Identity Anchor Factor

The user's directory identity — Employee ID, badge, or SCIM-provisioned principal. Ties the challenge to a specific human, with full audit trail.

See Deviceless Authentication

See Deviceless Authentication. Try It. Understand It in 60 Seconds.

Featured Demo

Self Enrollment or Auto Enroll Everyone at Once.

A narrated walkthrough of Deviceless MFA, the card, and how the three factors resolve locally.

1/6

Try Deviceless MFA Live

This is Deviceless MFA. Try it.→

No signup. No download. Resolve a live three-factor challenge against a printed card, right here — same flow a worker runs during an identity outage.

✓

No phone required

✓

No app required

✓

No network required

✓

No hardware token required

✓

No dependency on compromised systems

✓

Works in any language, including RTL and CJK

Identity Challenge CardCard ID: B7eCB15

#	A	B	C	D	E
1	INSTALL POWDER	GARDEN BRIDGE	MARBLE SILVER	ROCKET WINDOW	GUITAR CASTLE
2	PLANET ANCHOR	TURTLE FOREST	BASKET TEMPLE	VELVET PIRATE	COTTON DRAGON
3	CANYON MAGNET	PUZZLE ORANGE	VIOLET BEACON	COPPER JUNGLE	CARPET MONKEY
4	HARBOR KNIGHT	VISION QUARTZ	JASPER WILLOW	SUMMIT STREAM	PARROT FABRIC
5	MEADOW COBALT	FABRIC SPHINX	FALCON BINARY	ORCHID PRISM	LANTERN OXYGEN

Three-Factor Challenge

Challenge Card Factor

Coordinate C2 — TOP word

Private Knowledge Factor

Your PIN 1234

Identity Anchor Factor

Employee ID EMP-48291

How Three-Factor Works

· Challenge Card Factor — Find the coordinate (e.g., A1, B3) and enter the TOP or BOTTOM word

· Private Knowledge Factor — Read your 4-digit PIN, then enter it in the PIN field

· Identity Anchor Factor — Your Employee ID is verified automatically

· All three factors required — the word and PIN must both be correct to gain access

· New challenge — Tap 'New Game' to randomize a fresh coordinate and PIN

Outcomes by Role

The Business Value of Deviceless MFA Mapped to Who's Buying

Every stakeholder wins a different outcome. The Identity Challenge Card is the rare control where the CISO, CIO, CFO, CEO, service desk, and industry analyst each get their own answer.

Stop defending an exception list. Deviceless MFA that covers every worker, every environment — including the ones device-bound MFA can't reach.

MFA coverage for 100% of workers

Most MFA mandates require all users — but device-based solutions exclude factory floors, shared workstations, field staff, and contractors. The Challenge Card closes every exception, giving auditors complete coverage evidence with no asterisks.

Replay-proofZero Trust

Breach-resilient identity layer

Air-gapped authentication eliminates push-notification hijacking, SIM-swap, and real-time phishing attacks that defeat SMS and TOTP. The challenge/response is offline and unreplayable — no interception vector exists.

ResilienceIncident response

Audit-ready from day one

Card issuance, expiration, re-enrollment, and revocation are all logged and policy-enforced. Admins set expiry windows; users receive automated reminders. Every access event is traceable — no gaps in the audit trail.

AuditCMMCHIPAA

One IGA workflow provisions cards for every worker. No device procurement, no per-seat app install, no re-enrollment campaign.

Deployment in under an hour

No network dependency. No battery. No software patches. Business continuity plans that rely on device MFA have a documented failure mode — the Challenge Card functions through outages, disasters, and offline deployments that regulators increasingly require planning for.

IGASCIM

Works with your stack

No MDM enrollment. No app installs. No device provisioning. Cards are generated and distributed through your existing service desk workflow — users are live within minutes of receiving their card, not weeks of IT onboarding cycles.

SSOIdPInteroperable

Zero per-seat app licensing

Every hardware token and managed device is an inventory line, a support ticket, and a replacement cost. A printed card eliminates all three — with no battery to die, no firmware to patch, and no asset tag to track.

TCOLicensing

Printed cards at cents per worker replace a stack of app licenses, hardware tokens, and device refresh cycles.

Materially lower authentication spend

Cyber insurance underwriters now price device-bound MFA gaps into premiums. The Identity Challenge Card closes the 80% gap without hardware, without MDM, and without per-device licensing — the three costs that make universal coverage unaffordable.

TCOFinance

Material reduction in breach exposure

When Stryker's device-bound MFA went down, every hour of recovery carried a P&L cost — lost revenue, overtime, incident response fees. Deviceless MFA gives CFOs a continuity number they can defend in a board deck.

RiskMaterial impact

Continuity story for the board

Hardware tokens, MDM licenses, and device replacement cycles are the invisible tax on universal MFA. A printed Challenge Card replaces all three — no battery, no firmware, no asset tag, no refresh cycle. The math works at every headcount.

BoardGovernance

When the SEC asks what continuity plan you had when MFA went down, the Identity Challenge Card is the answer — in production, audited, and documented.

Defensible SEC 8-K disclosure

When a cyberattack takes down device-bound authentication, the board's question isn't which tool failed — it's how long the business was exposed. The Identity Challenge Card keeps workforce verification running through the incident, turning a headline risk into a footnote.

SEC8-K

Headline becomes a footnote

The SEC's four-day cyber disclosure rule turned identity failure into a material event. Deviceless MFA gives CEOs a defensible answer to the first question on every 8-K: "What continuity plan did we have for when device-bound MFA failed?"

ReputationContinuity

Every worker covered — every country

Identity resilience is becoming a board-level conversation. The Identity Challenge Card — Deviceless MFA — is the clearest instantiation of that category. CEOs get the upside of being the customer named in the analyst note, not the one in the breach case study.

GlobalWorkforce

When the card is the fallback, the help desk isn't the bottleneck. Workers self-resolve and you get your team back.

Self-service lockout resolution

Lost phone? Dead battery? No cell signal? The Challenge Card is always available — it works offline, requires no device, and gives the service desk a reliable identity verification method when every digital channel is down.

Self-serviceDeflection

Re-enrollment in seconds

Social engineering attacks target the help desk because knowledge-based verification is guessable. The Challenge Card replaces "mother's maiden name" with a cryptographic challenge/response that attackers cannot research, intercept, or replay.

Re-enrollmentGoverned

Audit trail in the same pane of glass

Major incidents create account-lockout surges. When MFA infrastructure is the problem, the card becomes the fallback that keeps the queue moving — no escalation to security, no manager override, no waiting for systems to come back online.

AuditIGA

Deviceless MFA is a greenfield category. 80% of the global workforce is the addressable market — and incumbents cannot ship this in an update.

Category-defining coverage

This is not another authenticator app. The Identity Challenge Card defines a new infrastructure layer — the Identity Continuity Layer — that ensures authentication persists when device-dependent systems fail, creating a category with no direct competitor.

CategoryMoat

Fortune-500-scale proof points

The addressable market spans three budget lines: MFA gap closure, service desk identity verification, and business continuity planning. Each use case opens a separate procurement path, expanding the total addressable market beyond traditional MFA competition.

EnterpriseRegulated

Clear comparison to FIDO2 and TOTP

No PII stored. No device required. Multilingual. Air-gapped capable. This is a fundamentally different architecture — not an incremental feature on an existing platform — which means incumbents cannot replicate it by shipping an update.

MarketComparison

Ready to close your compliance gaps with Deviceless MFA?

Book a 20-minute walkthrough tailored to your workforce — we'll map your exceptions to a deployment plan before you leave the call.

Book Meeting

Multilingual & Global

Built for Global Workforces

The Identity Challenge Card ships in 34 languages, including RTL Arabic and Hebrew and CJK Chinese, Japanese, and Korean. Same card, same three-factor flow — localized for every worker.

Compliance-Ready Deviceless MFA

Deviceless MFA, Trusted in Regulated Environments

Designed from day one for CMMC, HIPAA, PCI-DSS, GDPR, and FERPA workloads. Three architectural pillars make the compliance story simpler than device-bound MFA, not harder.

Privacy by Architecture

Zero personal data on the auth mechanism

No phone number, biometric, or personal data touches the card
Card contents are opaque without the user's PIN
Zero GDPR exposure from the authentication channel
No third-party processor between the user and the challenge
Revocation is immediate — no upstream device cleanup

Full Lifecycle Controls

Governed issuance, revocation, and audit

Every card is issued through the existing IGA workflow
Every challenge and re-issue writes an immutable audit record
Policy-enforced expiration and re-enrollment windows
Identity-verified re-issuance closes the social-engineering path
Separation of duties between issuer, approver, and auditor

Replay-Proof by Design

No push, no replay, no shared secret

No push notifications — push fatigue has no surface
Each coordinate value is one-time — replay is structurally impossible
Air-gapped verification — no network attack surface
No TOTP shared secret to exfiltrate
Offline verification with no shared secret to steal

Recognized on Gartner Peer Insights

4.4

Based on 14 verified reviews of AvatierIdentity Governance and Administration

Read the reviews on Gartner Peer Insights

Executive Briefing

Download White Paper + Product Sheets

The full category argument, the Stryker recovery narrative, and the product sheet — three PDFs for the CISO, CIO, and board packet.

Download White Paper (PDF)Download Enhanced Sheet (PDF)

Deviceless MFA FAQs

Frequently Asked Questions

The same questions come up in every CISO, CIO, CFO, CEO, service desk, and analyst call. Answers below — pick your persona.

Deviceless MFA for 100% of the workforce

What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?

Deviceless MFA is multi-factor authentication that works without a phone, an app, a hardware token, or a network connection. The Identity Challenge Card is the first production implementation: a printed grid of word pairs that a user looks up during login. When Stryker's device-bound MFA went down during the Iranian Handala intrusion, Deviceless MFA is the category that would have kept workforce verification running — under an hour to deploy, every worker covered, zero device dependency.

Is a printed card actually secure? A lost card means a compromised credential.

The card contains no personal data and no identity information. Without the PIN it is useless. A lost card is less dangerous than a lost phone — you can't SIM-swap paper. The card is revoked in seconds and replaced the same day. Cyber attackers cannot compromise paper. That is an architectural truth, not a tagline.

We already have MFA. Why does our existing solution leave a documented gap?

Authentication that works for 20% of your workforce does not protect your organization — it creates a documented 80% vulnerability. Every MFA exception you've written is a gap an attacker can map. Device-dependent MFA assumes devices, networks, and identity systems are available. During the Stryker attack, none of those assumptions held. Deviceless MFA is how you stop documenting 80% exceptions and start documenting 100% coverage.

Can push bombing or replay attacks work against this?

No. There are no push notifications — so push fatigue attacks have no surface. Each coordinate value is one-time — used values are permanently burned and never reused. Replay attacks are structurally impossible. Air-gapped Deviceless MFA means no network attack surface exists.

See Where Deviceless MFA Fits in Your Environment

No commitment · 30-min Deviceless MFA walkthrough · same-day response

Talk to the team behind the Identity Challenge Card — the first production Deviceless MFA.

Compliance-Certified

Live security rating from SecurityScorecard

SOC 2 Type II — Deviceless MFA compliance certification

SOC 2 Type IIAudited operational controls

ISO/IEC 27001 — Deviceless MFA compliance certification

ISO/IEC 27001Information security management

PCI DSS v4.0.1 — Deviceless MFA compliance certification

PCI DSS v4.0.1Payment card data handling

GDPREuropean data protection

FERPA — Deviceless MFA compliance certification

FERPAEducation-record privacy

Section 508Accessibility compliance

Avatier Trust Center

Review our certifications, subprocessors, uptime, and security posture — continuously published and audited.

Open Trust Center

Related from the Identity Challenge Card library

View all articles

Phishing-resistant MFA for enterprise in 2026 — the regulatory framing (CISA, NIST 800-63B Rev. 4, Executive Order 14028), what qualifies (passkeys, hardware FIDO2 keys, deviceless FIDO2 cards, smart cards), what does not (SMS OTP, push-approval, soft-OTP), and the deployment architecture across managed devices, frontline, privileged accounts, and recovery channels.

Phishing-Resistant MFA: What CISA and NIST Require and How to Deploy It in an Enterprise

Phishing-resistant MFA is the term CISA, NIST 800-63B Rev. 4, and Executive Order 14028 use for the authentication category that survives the attack patterns that defeated SMS, OTP, and push-approval MFA. The 2026 enterprise reference on what qualifies, what doesn't, and the deployment architecture across mixed workforces.

The authentication architecture gap that phishing-resistant MFA does not close — service-desk recovery flows, password reset workflows, and human-touchpoint verification, where 2026 attackers are landing instead of attacking the credential directly.

Beyond Foundational MFA in 2026: The Recovery Channel Gap

Phishing-resistant MFA is the right answer for the front door. It does not protect the recovery channel, which is where the 2026 attacks are landing.

Enterprise multi-factor authentication buyer's guide for 2026 — segmented by workforce type

Best MFA Solutions for Enterprise in 2026, Compared by Workforce Type

A 2026 buyer's guide to enterprise MFA solutions, segmented by workforce type. Compare 12 vendors across desk, frontline, contractor, and customer use cases.

View all articles

Identity Challenge Card

Three Use Cases, One Printed Card

Verify the Human

Login, With or Without a Password

Self-Service Password Reset

Identity Challenge Card for Mobile Wallets

Device-Dependent MFA Can't Protect Workers Who Don't Have a Device

The Iranian Handala Stryker Attack Is Why Deviceless MFA Exists.

Device-Dependent MFA vs Deviceless Authentication

Three Factors. Zero Device Dependency.

Challenge Card Factor

Private Knowledge Factor

Identity Anchor Factor

See Deviceless Authentication. Try It. Understand It in 60 Seconds.

Self Enrollment or Auto Enroll Everyone at Once.

This is Deviceless MFA. Try it.→

The Business Value of Deviceless MFA Mapped to Who's Buying

Ready to close your compliance gaps with Deviceless MFA?

Built for Global Workforces

Deviceless MFA, Trusted in Regulated Environments

Privacy by Architecture

Full Lifecycle Controls

Replay-Proof by Design

4.4 / 5

Download White Paper + Product Sheets

Frequently Asked Questions

What exactly is Deviceless MFA — and how is the Identity Challenge Card different from every other MFA?

Is a printed card actually secure? A lost card means a compromised credential.

We already have MFA. Why does our existing solution leave a documented gap?

Can push bombing or replay attacks work against this?

See Where Deviceless MFA Fits in Your Environment

Avatier Trust Center

Related from the Identity Challenge Card library

Phishing-Resistant MFA: What CISA and NIST Require and How to Deploy It in an Enterprise

Beyond Foundational MFA in 2026: The Recovery Channel Gap

Best MFA Solutions for Enterprise in 2026, Compared by Workforce Type

4.4