The ReliaQuest incident should change the way every CISO thinks about authentication.
In August 2026, ReliaQuest disclosed that an attacker created a convincing lookalike single sign-on page, called employees while impersonating internal security personnel, obtained a valid password, and persuaded one employee to approve an MFA push notification. At that point, the attacker possessed what many enterprise architectures still treat as sufficient evidence of identity: correct credentials and a completed second factor.
ReliaQuest’s device trust controls ultimately prevented access to its applications and systems. That was a textbook example of defense in depth, but it was also a warning about the authentication layer that came before it. MFA did what it was configured to do. It checked a second factor. The weakness was that the second factor depended on a human decision. Once an authentication flow asks an employee to click Allow, disclose a code, or decide whether a request feels legitimate, part of the security model has become a trust exercise.
This weakness extends well beyond fraudulent phone calls. SMS codes, time-based one-time passwords, and standard push notifications remain vulnerable to adversary-in-the-middle attacks. A reverse proxy can sit between the victim and the legitimate identity provider, relay the credentials and second factor in real time, and capture the authenticated session that follows. The attacker does not need to defeat the second factor. The attacker persuades the legitimate user to satisfy it.
Generative AI raises the stakes because deception is becoming cheaper, faster, and more convincing. AI-generated phishing emails make it through defenses that once caught obvious scams. Attackers can produce polished phishing portals, personalized scripts, cloned voices, and synthetic video with very little effort. This is particularly important for remote face and voice verification, where the identity signal itself can be synthesized or replayed. Local biometrics performed inside a trusted device are a different security model, but remote biometric signals should no longer be treated as inherently trustworthy simply because they look or sound human.
Passkeys are an important response. FIDO2 and WebAuthn replace reusable secrets with public key cryptography and bind authentication to the legitimate origin, making conventional credential phishing dramatically harder. Enterprises should adopt those improvements. But CISOs should also resist treating the word passkey as if it describes a single assurance level. It actually describes a range of implementations from “not very secure” to “very secure.”
A passkey can be synced across a consumer cloud ecosystem or bound to one physical device. It can depend on the security of a general-purpose operating system, browser, password manager, mobile device, or recovery workflow. The FIDO Alliance itself states that biometric device-bound passkeys in modern hardware security keys offer the highest security assurance, and its enterprise guidance notes that synced passkeys are likely insufficient for high assurance use cases.
Independent research shows why that distinction matters. At USENIX Security 2026, researchers evaluated 103 passkey-enabled websites and found that 53 were vulnerable to at least one attack with a high severity score. Two critical attack types were discovered on 18 sites. The researchers were not demonstrating a failure of public key cryptography. They were exposing weaknesses in how passkeys were implemented, managed, and integrated into the surrounding identity system.
Research presented by SpecterOps at Black Hat USA 2026 reached a similar conclusion from the enterprise endpoint side. Its Pass the Passkey work demonstrated that some implementations could expose authentication assertions, permit replay, or allow attackers to manipulate the authentication flow. In one vulnerability chain, researchers impersonated privileged users while phishing-resistant MFA remained enforced. Again, the lesson was not that FIDO2 cryptography had failed. The lesson was that authentication is a system, not merely a cryptographic primitive.
For CISOs, this changes the objective. The goal should not simply be passwordless authentication. The goal should be high-assurance identity.
For the highest consequence enterprise access, that increasingly means moving the cryptographic root of trust out of a general-purpose endpoint and into dedicated hardware. The strongest practical architecture available today combines dedicated device-bound FIDO2 credentials, a secure hardware element, cryptographic origin verification, and local biometric user verification performed on the authenticator itself. Where appropriate, physical proximity between the authenticator and the computer requesting access can add another signal of presence.
This model removes several categories of remote attack at once. There is no code for an employee to disclose and no push notification for an attacker to persuade someone to approve. The private credential does not need to synchronize through a personal cloud account. The biometric reference remains local to the dedicated authenticator. A spoofed domain cannot simply request a valid signature for another relying party. A stolen password therefore becomes dramatically less useful because possession of information is no longer sufficient to establish identity.
Dedicated hardware does introduce operational considerations. Devices must be provisioned, replaced when lost, managed across remote workforces, and supported by recovery processes that do not recreate the weaknesses the organization was trying to eliminate. Those are real issues, but they argue for thoughtful deployment rather than weaker authentication.
A pragmatic approach is to begin with identities where compromise produces disproportionate damage. Privileged administrators, executives, finance teams, developers with production access, security personnel, and employees authorized to approve sensitive transactions are obvious candidates. Organizations can then expand hardware-bound biometric authentication while systematically eliminating legacy push prompts, weak recovery methods, and unmanaged credentials.
The important shift is conceptual. Authentication should not be a request for permission from a user who may be under attack. It should be a cryptographic demonstration that the registered person, the registered authenticator, and the legitimate service are participating in the same transaction.
MFA was an essential improvement over passwords. Passkeys are another improvement, but represent a range of options. For high assurance enterprise identity, standards guidance and current research are pointing toward the same destination: dedicated device- bound hardware, strong origin verification, local biometric user verification, and recovery processes that preserve that assurance.
The objective is not to add another factor. It is to prevent the attacker from ever becoming an authenticated user in the first place.
Join our LinkedIn group Information Security Community!
