Cisco Duo
MFA and device trust, with support for passkeys and security keys.
Access Control
Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
Addresses 287 stories in our coverage in the last 90 days 4 products that provide it
What it is
Multi-factor authentication with FIDO2 security keys or passkeys, where the login is cryptographically tied to the real website. Unlike SMS codes and push approvals, it cannot be relayed through a fake login page or approved by a tired user.
How to value it
Most breaches still start with a valid login: a phished password, one reused from an old leak, or an MFA prompt approved by mistake. Phishing-resistant MFA removes that whole class of attack for the systems it covers, which is why regulators and cyber insurers increasingly ask for it. The cost is mostly rollout effort and hardware keys for staff who cannot use passkeys. Set it against the cost of one compromised email or admin account.
Questions to ask a vendor
- 1Does it support FIDO2 and passkeys, and can we enforce them and switch off SMS and push fallbacks?
- 2How are lost keys and new phones handled without the help desk becoming the new weak spot?
- 3Which of our systems can it cover today: email, VPN, SaaS apps, older applications?
- 4Can we report on who still uses weaker methods?
For your risk register
- Risk
- Account takeover through phished or reused credentials.
- Control
- Phishing-resistant MFA (FIDO2 or passkeys) on email, remote access and admin accounts.
- Owner
- Identity and access lead.
- Measure
- Share of users and admin accounts on phishing-resistant methods.
A starting point: set the owner and measure to fit your organisation.
Products that provide it
Listed alphabetically by vendor. A listing is not a recommendation: use the questions above to compare them, or tick up to 3 to see them side by side.
Microsoft Entra ID
Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.
Okta Workforce Identity
Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.
YubiKey
Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.
Recent stories it addresses
753 stories in total- 13 Nov 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
North Korean hackers stole over $400M in crypto using deepfake video calls.
- 13 Nov 2026FBI Disrupts North Korean FaceStealer Scheme Behind $400M Crypto Theft
FBI disrupts North Korean FaceStealer scheme, stealing over $400M in crypto.
- 13 Nov 2026SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users
SilentAir spies on Taiwanese users by hijacking Asian telecom networks to intercept SMS 2FA codes.
- 13 Nov 2026Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
North Korean hackers stole $400M+ using fake Zoom calls with victim webcam footage.
- 13 Nov 2026How attackers turned a Teams meeting booking into a device code phishing trap
Attackers used a fake Teams scheduler to trick an employee into approving a device code sign-in.
- 13 Nov 2026TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider
TSMC confirms employee data exposed online via third-party cloud provider.
- 13 Nov 2026US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
US seizes North Korean hacking infrastructure and over $1.2B in crypto stolen from Binance.
- 12 Nov 2026Apify rotates API tokens, prompts 2FA resets after breach
Apify rotates API tokens and resets 2FA after detecting unauthorized access to internal systems.
How we list vendors
- A product is listed because it provides the control. Nobody pays to be listed, and on story pages the examples rotate, so no vendor is always first.
- Vendor pages show both the vendor's own research and the incidents involving its products, from our own coverage. We do not leave either out.
- Our summaries are written by us, based on the vendors' own pages. Text in quotation marks or marked "in their own words" is the vendor's own, quoted from its website.
- Logos, product names and quoted text belong to the vendors and are shown to identify them.
- Something wrong? Use "Suggest a correction" on the vendor's page. A product we should look at? Email support@threatnoir.com.