MFA that resists phishing, and the help-desk reset that gets around it

82% of initial-access detections are now malware-free: stolen credentials, hijacked sessions and MFA fatigue instead of malicious attachments (CrowdStrike 2026). The average time from first access to moving through the network is down to 29 minutes, and the fastest observed was 27 seconds. Most incidents we see start with a login, not an exploit.

Why a code by text is no longer enough

A one-time code sent by SMS or shown in an app can be phished in real time: the attacker’s page asks for it and passes it straight to the real login. “MFA fatigue” is cruder, sending push prompts until a tired employee taps approve. Both work often enough that they are standard technique.

Phishing-resistant MFA, meaning FIDO2 security keys or passkeys, ties the login to the real site. There is no code to type into a fake page and nothing to approve by mistake. It is the current bar, and Windows, macOS, iOS and Android all support passkeys natively.

The reset that bypasses all of it

The signature technique of 2025 was simply calling the IT help desk and talking a person into a password or MFA reset. Major retailers and manufacturers lost weeks of operations to intrusions that began with one phone call. A perfect MFA deployment is undone by a reset process that trusts a voice on the phone, and voice cloning has made the voice worthless as proof.

A hardened reset process means: identity verified through a channel the caller does not control (a callback to a number on file, a manager’s confirmation, or an in-person check), no resets on the strength of personal details an attacker can find online, and every reset logged and reviewed.

Everywhere, with single sign-on

MFA on email alone leaves the finance system, the CRM and the admin consoles open. Single sign-on wherever it is supported puts one strong login in front of everything, and a joiner-mover-leaver process that HR actually follows means access ends the day a person does. Unmanaged devices should not reach company data at all.

Where to start

Turn on phishing-resistant MFA for administrators and finance first, then everyone. Write the reset procedure down and rehearse it with the help desk. Then look at email, which is still the front door: Email security: SPF, DKIM and DMARC.

The identity layer and the tools we work with are described on Security. The current threat picture, with sources, is in the threat report.