Industry analysts and investors tracking the identity market.
Showing 34 posts
Going passwordless doesn't automatically satisfy an auditor. Here is what NIST, SOX, HIPAA, and PCI reviewers actually check in a passwordless deployment, and where the evidence gaps show up first.
Weak OTP fails at four specific points — SIM swap, real-time phishing relay, SS7 interception, and MFA fatigue — and every one of them is a known, repeatable attacker technique in 2026.
Multi-factor authentication only works when the factors are genuinely different — this 2026 reference clears up what counts as a real factor and what advanced MFA actually means.
OTP does not stop every attack, but it reliably defeats credential stuffing, password-spray, basic brute force, and stolen-password reuse from unrelated breaches. The 2026 breach-prevention case for OTP — the attack chains it breaks, the ones it doesn't, and how to deploy it so the prevention benefit actually lands.
Passwordless authentication doesn't earn HIPAA certification — HIPAA doesn't certify vendors — but it directly strengthens the §164.312 access-control safeguards clinical IT teams are graded on.
Windows Hello does one thing extremely well — it produces a strong, TPM-bound, biometric or PIN sign-in on the specific Windows device a user enrolled on. The limitations show up the moment authentication needs to leave that device: shared and kiosk workstations, roaming across machines, cross-platform access, and the per-device enrollment burden. The 2026 practitioner reference on how Windows Hello actually works, exactly where its device-bound model falls short, and the FIDO2 and passkey patterns that extend it to the endpoints Hello was never designed to cover.
OTP fails less on cryptography than on deliverability, SIM-swap and phishing exposure, UX friction, and compliance. The real challenges of one-time passwords in 2026 — and how to implement OTP well.
One-time passwords live or die by NIST SP 800-63B verifier rules — rate-limiting, replay resistance, no email OTP, restricted SMS. What the standard requires in 2026, and when to move past OTP.
Single-factor authentication still runs most login events on earth, and most of the advice about it is a strawman. The 2026 reference on what SFA actually is, where it remains defensible, why factor independence decides whether you really have MFA, and the failure ladder from password-only to phishing-resistant FIDO2.
Enterprise passwordless implementation runs on a specific eight-step deployment sequence — workforce inventory, credential-class selection per segment, IdP configuration, pilot enrollment, workforce rollout with change management, help desk pre-scaling, monitoring and iteration, and passwordless-fallback residual planning. The 2026 enterprise reference on the step-by-step deployment playbook, the go/no-go criteria at each phase gate, and the discipline that produces successful passwordless rollout at workforce scale.
Microsoft enterprise environments have a specific passwordless deployment architecture — Windows Hello for Business as the primary Windows authentication factor, Entra ID as the identity broker for cloud application access, Windows Autopilot and Intune for device provisioning, and the hybrid deployment patterns that bridge on-premises AD to Entra ID. The 2026 enterprise reference on the Microsoft-stack passwordless architecture, the WHfB enrollment ceremony discipline, and the deployment pattern that produces phishing-resistant workforce authentication across the Microsoft estate.
One-time passwords fail in specific, patterned ways at enterprise scale — SMS interception through SS7 and SIM-swap, TOTP time drift and device loss, push-notification MFA fatigue, hardware token failures, and the recovery-channel gap that determines whether the failure produces a help desk ticket or a security incident. The 2026 enterprise reference on how OTP actually fails in production and what to deploy instead.
Mobile biometric authentication has quietly become the primary phishing-resistant credential class for enterprise workforce authentication. The 2026 enterprise reference on what's actually happening on modern mobile devices, how platform passkeys and biometric unlock compose into FIDO2 authentication, and where mobile biometric MFA still needs step-up to a hardware key or deviceless credential.
The enterprise shift from passwords to biometrics isn't a technology purchase — it's a multi-year architectural migration with distinct phases, risk-tiered rollout, federation-parallel-run patterns, and fallback design that determines whether the shift succeeds or produces a support-burden crisis. The 2026 organizational reference on how the migration actually runs at workforce scale, distinct from the mobile-biometric-specific architecture that dominates operator-level attention.
Both hardware FIDO2 keys and passkeys deliver phishing-resistant authentication using the WebAuthn standard. Operationally they're substantially different — portability, recovery patterns, cost at scale, and credential sovereignty all diverge. The 2026 enterprise buyer's reference on which credential class fits which workforce segment, where each breaks, and why most mature deployments compose both.
For sixty years, sci-fi has been showing us biometric authentication — palm scans, retinal lasers, voice prompts, faces unlocking doors. Now most of us authenticate with biometrics every morning before we've finished our coffee. What did sci-fi get right, what did it get hilariously wrong, and what does workforce biometric authentication actually look like in 2026?
MFA is the credential class that defeats phishing and credential theft. It cannot defeat the four attack patterns that don't require defeating MFA — toxic entitlement accumulation, insider misuse, shadow admin accounts, and privileged session abuse. The 2026 enterprise reference on the IGA layer above MFA that closes the gap MFA structurally cannot.
AI agents need identities, credentials, and authentication ceremonies of their own — separate from the humans they act on behalf of, separate from the service accounts they're often confused with. The 2026 enterprise reference on the architectures that issue agent identity, the protocols that authenticate them, the delegation chain that keeps user authority intact, and where agentic auth deployments break.
Authentication at session establishment isn't enough for privileged users, financial-system operators, defense workloads, or executive accounts. Continuous authentication re-evaluates identity assurance at every protected resource access, every session checkpoint, every risk-signal change. The 2026 enterprise reference on the architecture, the signal stream, and the high-risk segments where the pattern is now expected.
Single Sign-On for a distributed workforce — remote employees, hybrid schedules, contractor populations, partner organizations, and education-sector users — isn't the same problem it was when SSO meant SAML inside a corporate intranet. The 2026 reference on what SSO actually solves, where the architectural breakage modes live, and the federation patterns that survive contact with mixed workforces.
Adaptive authentication evaluates risk signals at every session and adjusts the authentication requirement to match — stronger MFA when risk is high, frictionless access when risk is low. The 2026 enterprise reference on the signals that actually matter, the architecture that composes risk with phishing-resistant MFA, and where adaptive deployments break.
Phishing-resistant MFA is the term CISA, NIST 800-63B Rev. 4, and Executive Order 14028 use for the authentication category that survives the attack patterns that defeated SMS, OTP, and push-approval MFA. The 2026 enterprise reference on what qualifies, what doesn't, and the deployment architecture across mixed workforces.
A 2026 buyer's guide to enterprise MFA solutions, segmented by workforce type. Compare 12 vendors across desk, frontline, contractor, and customer use cases.
Authentication proves who you are; authorization decides what you can do. The boundary sounds clean — but the implementation decisions that follow are where most enterprise identity systems break. The 2026 reference on the boundary, the protocols that span it, and the architecture that gets both layers right.
Push-bombing and MFA fatigue attacks defeat MFA by exhausting the user, not the cryptography. The 2026 defense patterns — number matching, push throttling, phishing-resistant migration, and the architecture that survives the attack vector that took down Uber, Cisco, and a long list of enterprises since 2022.
Biometric authentication is no longer a Hollywood prop — it's the dominant unlock mechanism for every passkey deployed in 2026. The honest enterprise guide to which biometrics are production-grade, which are still demo-only, and how biometrics fit into the workforce MFA architecture.
Passkeys are the strongest workforce authenticator most enterprises can deploy in 2026. The playbook covers what passkeys actually are, where they break in production, and the phased deployment that survives contact with enterprise reality.
The real reasons enterprises deploy MFA — what's changed since 2024, what Storm-2949 taught us about the recovery channel, and how to evaluate whether your MFA architecture is actually doing the job.
How to scale OTP across an enterprise in 2026 — channel selection, recovery design, workforce segmentation, and where OTP belongs in a phishing-resistant architecture.
Phishing-resistant MFA is the right answer for the front door. It does not protect the recovery channel, which is where the 2026 attacks are landing.
When one-time passwords still hold up in 2026, when they don't, and the phishing-resistant alternatives that have replaced them for high-impact use cases.
What the Stryker attack revealed about device-dependent MFA — and what phishing-resistant authentication actually means in an era of AiTM session theft.
A 2026 buyer's guide to enterprise passwordless authentication, segmented by workforce type. Compare 15 vendors across desk, frontline, contractor, and customer use cases.
Why Avatier uses its own identity products internally — and why Microsoft, Rippling, and other SaaS leaders are doing the same with their own toolchains.