Not Just Passkeys: Rethinking the Scope of Phishing-Resistant MFA​

Phishing-resistant MFA can strengthen the login—but attackers are increasingly looking for other ways around that protection, including enrollment and recovery processes, help desk interactions, session theft, and fallback authentication.

In this session, you’ll explore how to think about phishing resistance as a system-wide property, not a point-in-time event. Examine where identity protections can break down across the user lifecycle and what it takes to extend stronger authentication beyond the initial login.

You’ll explore practical approaches to identity verification during enrollment and recovery, proximity-based authentication where hardware tokens aren’t viable, passwordless architectures, protections against session theft, and ways to carry phishing-resistant trust into environments that don’t natively support it.

You’ll leave with a clearer understanding of where gaps can exist in today’s identity protections, the implementation challenges MSPs may encounter across diverse client environments, and practical considerations for building a more comprehensive approach to phishing-resistant authentication.