Phishing-resistant MFA · FIDO2 passkeys · authentication coverage
Not All MFA Stops a Real Attacker
You deployed MFA. You still can't prove it's enforced everywhere.
Multi-factor authentication is live on corporate email and the VPN. But cloud management consoles, CI/CD pipelines, developer tools, and third-party SaaS are where coverage quietly thins out. Attackers exploit exactly that inconsistency: a strong front door means little if side doors stay open. And the MFA you do have may be the phishable kind, relaying your push approvals straight to a fraudulent site in real time.
THE IDENTITY & ACCESS MANAGEMENT PROGRAM TOOLKIT
Get instant access
- Phishing-resistant vs phishable MFA, with real attack context
- A risk-tiered authentication model you can apply
- Coverage measured as a defensible ratio by risk tier
Download the toolkit
The gap isn't whether you have MFA. It's which MFA, and where.
Push notifications and TOTP codes can be intercepted by adversary-in-the-middle proxy frameworks that relay the authentication session transparently, so the attacker rides in behind a legitimate login. FIDO2/WebAuthn passkeys and certificate-based authentication defeat this attack class by cryptographically binding the credential to the real relying-party domain. The toolkit shows you how to tell these apart and how to measure the coverage you actually have.
What's inside
On authentication specifically
Outcomes
What you can do once you've read it
Authentication is one domain. The toolkit covers all six.
Uneven MFA rarely travels alone. The same programs carry orphaned accounts, unrotated service credentials, and rubber-stamped access reviews, and that unevenness is exactly where breaches occur. This toolkit spans the full surface area: authentication, authorization and access governance, privileged access management, identity lifecycle, service and machine identities, and identity governance and administration. It treats service accounts and machine identities as a first-class problem, including CIEM for multi-cloud, not an afterthought.
Why it's credible
Grounded in real tooling, standards, and benchmarks
Questions, answered
It's built to support program assessment, vendor evaluation, and roadmap planning, with concrete timeframes, control checklists, and reference tables rather than principles alone.
Yes. It includes interim risk-reduction measures, such as number-matching challenges and conditional access that restricts authentication from unmanaged devices, for when phishing-resistant MFA can't be deployed at scale immediately.
CISOs, IAM leads, and IT security managers standing up or maturing an identity program, plus the executives and boards who need the risk framed in measurement terms.
It addresses cloud console roles, service principals, and workload identities directly, and treats CIEM as a required component for organizations running significant cloud infrastructure.
No. Products and standards are named as examples for identification only; the toolkit gives you selection criteria grounded in operational reality, not endorsements.
25-PAGE TOOLKIT · 8 SECTIONS