As organisations race to implement zero-trust frameworks, is password-less authentication truly inevitable, and what friction points stand in the way?
Phishing resistance is now a necessity as attackers leverage AI to supercharge social engineering, generate hyper-personalised lures, and automate compromise attempts.
Dr. Tina Srivastava of MIT was one to raise this pragmatic stance as she shared the stage at Identity Week America with Sarah Handler from Netflix, Nader Nassar at Capital One, and Andrew Candella who works at Ciena.
Together, they reflected on end-user training not being inadequate enough as one of the biggest challenges, especially as once longstanding advice that taught users never to click links in unexpected emails is being discarded. As magic links and email-based authentication flows are more and more marketed as “secure” login methods, that rule has essentially gone out the window, confusing end users and creating new vectors for credential harvesting, Tina Srivastava says.
She said, whilst implementing passkeys can ensure “one flow is streamlined, other flows, like change device and account recovery can become much more phishable, insecure, and cumbersome”.
An audience member, Hutch raised an interesting point that for workforce authentication, he’s heard a number of enterprises express that concerns around synchronised passkeys have led them to require device-bound passkeys instead.
“That provides greater enterprise control over the credential, but it can also introduce considerable lifecycle overhead. What have your experiences been with that trade off? How have you handled new-device provisioning, device replacement, lost or damaged devices, recovery, and maintaining multiple authenticators without recreating the same help-desk burden we were trying to eliminate by getting rid of passwords? And has that experience changed your thinking about whether device-bound passkeys are the right long-term answer for the enterprise, or whether securely managed synchronization ultimately needs to be part of the solution?”
AI is supercharging social engineering and hyper-personalised lures, making legacy passwordless recovery paths phishable. Identity Week Europe 2027 tackles this exact risk across the AI and Cybersecurity and Fraud Detection tracks, featuring sessions on “As deepfake social engineering spreads, can detection alone keep up?” and whether generative AI is shifting fraud vectors faster than defences can respond.
