[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:phishing-resistant-mfa":3},{"control":4,"products":25,"stories":58,"lessons":102,"related":127,"compare":148},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.","Multi-factor authentication with FIDO2 security keys or passkeys, where the login is cryptographically tied to the real website. Unlike SMS codes and push approvals, it cannot be relayed through a fake login page or approved by a tired user.","Most breaches still start with a valid login: a phished password, one reused from an old leak, or an MFA prompt approved by mistake. Phishing-resistant MFA removes that whole class of attack for the systems it covers, which is why regulators and cyber insurers increasingly ask for it. The cost is mostly rollout effort and hardware keys for staff who cannot use passkeys. Set it against the cost of one compromised email or admin account.",[11,12,13,14],"Does it support FIDO2 and passkeys, and can we enforce them and switch off SMS and push fallbacks?","How are lost keys and new phones handled without the help desk becoming the new weak spot?","Which of our systems can it cover today: email, VPN, SaaS apps, older applications?","Can we report on who still uses weaker methods?","Risk: account takeover through phished or reused credentials. Control: phishing-resistant MFA (FIDO2 or passkeys) on email, remote access and admin accounts. Owner: identity and access lead. Measure: share of users and admin accounts on phishing-resistant methods.",[17,18,19,20],"NIS2 Art. 21(2)(j): multi-factor authentication","DORA Art. 9: strong authentication mechanisms","CIS Controls 6.3 to 6.5: MFA for external apps, remote access and admin access","ISO\u002FIEC 27001:2022 A.8.5: secure authentication",{"name":22,"slug":23},"Access Control","access-control","2026-10-16T12:47:53.910602+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"total":59,"last_days":60,"recent":61},754,288,[62,67,72,77,82,87,92,97],{"slug":63,"title":64,"published_at":65,"brief":66},"north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0","North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure","2026-11-13T21:19:30+00:00","DOJ seizes $1.2B in crypto, disrupts North Korean hacker infrastructure and FaceStealer scheme.",{"slug":68,"title":69,"published_at":70,"brief":71},"fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f","FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls","2026-11-13T14:28:58+00:00","North Korean hackers stole over $400M in crypto using deepfake video calls.",{"slug":73,"title":74,"published_at":75,"brief":76},"fbi-disrupts-north-korean-facestealer-scheme-behind-400m-crypto-theft-82acab","FBI Disrupts North Korean FaceStealer Scheme Behind $400M Crypto Theft","2026-11-13T14:17:17+00:00","FBI disrupts North Korean FaceStealer scheme, stealing over $400M in crypto.",{"slug":78,"title":79,"published_at":80,"brief":81},"silentair-hijacks-asian-telecom-networks-to-intercept-sms-2fa-codes-and-spy-on-t-7f22b6","SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users","2026-11-13T11:10:40+00:00","SilentAir spies on Taiwanese users by hijacking Asian telecom networks to intercept SMS 2FA codes.",{"slug":83,"title":84,"published_at":85,"brief":86},"stolen-webcam-clips-of-900-victims-feed-north-korea-s-400-million-fake-zoom-sche-c4b5f9","Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme","2026-11-13T06:30:30+00:00","North Korean hackers stole $400M+ using fake Zoom calls with victim webcam footage.",{"slug":88,"title":89,"published_at":90,"brief":91},"how-attackers-turned-a-teams-meeting-booking-into-a-device-code-phishing-trap-a964a8","How attackers turned a Teams meeting booking into a device code phishing trap","2026-11-13T06:15:48+00:00","Attackers used a fake Teams scheduler to trick an employee into approving a device code sign-in.",{"slug":93,"title":94,"published_at":95,"brief":96},"tsmc-data-breach-employee-data-exposed-via-third-party-cloud-provider-e36f61","TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider","2026-11-13T05:25:43+00:00","TSMC confirms employee data exposed online via third-party cloud provider.",{"slug":98,"title":99,"published_at":100,"brief":101},"us-seizes-north-korean-hacking-infrastructure-1-2-billion-in-cryptocurrency-stol-46736a","US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance","2026-11-13T00:32:19+00:00","US seizes North Korean hacking infrastructure and over $1.2B in crypto stolen from Binance.",[103,107,111,115,119,123],{"slug":104,"title":105,"published_at":106},"north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","2026-11-13T22:21:35.043+00:00",{"slug":108,"title":109,"published_at":110},"north-korean-deepfake-video-calls-drain-400m-in-crypto","North Korean Deepfake Video Calls Drain $400M in Crypto","2026-11-13T16:23:15.645+00:00",{"slug":112,"title":113,"published_at":114},"device-code-phishing-bypasses-mfa-by-abusing-legitimate-microsoft-auth-flow","Device Code Phishing Bypasses MFA by Abusing Legitimate Microsoft Auth Flow","2026-11-13T08:22:33.154+00:00",{"slug":116,"title":117,"published_at":118},"north-korean-deepfake-zoom-scam-steals-400m-using-victims-own-webcam-footage","North Korean Deepfake Zoom Scam Steals $400M Using Victims' Own Webcam Footage","2026-11-13T08:22:15.551+00:00",{"slug":120,"title":121,"published_at":122},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","2026-11-13T06:20:42.501+00:00",{"slug":124,"title":125,"published_at":126},"north-korean-social-engineering-campaign-steals-12b-via-fake-meetings-and-account-hijacking","North Korean Social Engineering Campaign Steals $1.2B via Fake Meetings and Account Hijacking","2026-11-13T01:20:21.778+00:00",[128,132,136,140,144],{"slug":129,"name":130,"problem":131},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":133,"name":134,"problem":135},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":137,"name":138,"problem":139},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":141,"name":142,"problem":143},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",{"slug":145,"name":146,"problem":147},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"yubico\u002Fyubikey":149,"microsoft\u002Fentra-id":163,"okta\u002Fworkforce-identity":182,"cisco\u002Fduo":200},{"hq_country":150,"also_provides":151,"reviews":152,"affected":162,"reported":162},"SE",[],[153,156,159],{"label":154,"url":155},"Gartner Peer Insights: Yubico YubiKey user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fyubico-yubikey",{"label":157,"url":158},"PeerSpot: Yubico YubiKey user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fyubico-yubikey-reviews",{"label":160,"url":161},"NIST FIPS 140-3 certificate #5291: YubiKey 5 Cryptographic Module","https:\u002F\u002Fcsrc.nist.gov\u002Fprojects\u002Fcryptographic-module-validation-program\u002Fcertificate\u002F5291",0,{"hq_country":164,"also_provides":165,"reviews":167,"affected":180,"reported":181},"US",[166],{"slug":137,"name":138},[168,171,174,177],{"label":169,"url":170},"AV-TEST: business results for Microsoft Defender","https:\u002F\u002Fwww.av-test.org\u002Fen\u002Fantivirus\u002Fbusiness-windows-client\u002Fmanufacturer\u002Fmicrosoft\u002F",{"label":172,"url":173},"ITPro: Microsoft Defender for Business review (2024)","https:\u002F\u002Fwww.itpro.com\u002Fcloud\u002Fcloud-security\u002Fmicrosoft-defender-for-business-review-feature-filled-enterprise-security-for-small-businesses",{"label":175,"url":176},"PeerSpot: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fmicrosoft-defender-for-endpoint-reviews",{"label":178,"url":179},"Gartner Peer Insights: Microsoft Defender for Endpoint user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fmicrosoft-defender-for-endpoint",311,128,{"hq_country":164,"also_provides":183,"reviews":185,"affected":198,"reported":199},[184],{"slug":137,"name":138},[186,189,192,195],{"label":187,"url":188},"TechRadar: Okta review (2023)","https:\u002F\u002Fwww.techradar.com\u002Freviews\u002Fokta-review",{"label":190,"url":191},"PeerSpot: Okta Platform user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fokta-platform-reviews",{"label":193,"url":194},"Gartner Peer Insights: Okta Workforce Identity user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fokta-workforce-identity",{"label":196,"url":197},"CSO Online: Okta bets on identity to control AI agents, but is identity enough? (2026)","https:\u002F\u002Fwww.csoonline.com\u002Farticle\u002F4225230\u002Fokta-bets-on-identity-to-control-ai-agents-but-is-identity-alone-enough.html",5,2,{"hq_country":164,"also_provides":201,"reviews":202,"affected":215,"reported":216},[],[203,206,209,212],{"label":204,"url":205},"CyberRatings 2025 Q3 SSE Report: Cisco","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q3-sse-report-cisco\u002F",{"label":207,"url":208},"PeerSpot: Cisco Secure Firewall user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fcisco-secure-firewall-reviews",{"label":210,"url":211},"Gartner Peer Insights: Cisco Secure Firewall user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fcisco-secure-firewall",{"label":213,"url":214},"CyberRatings 2025 Q4 Enterprise Firewall Report: Cisco","https:\u002F\u002Fcyberratings.org\u002Fresources\u002F2025-q4-enterprise-firewall-report-cisco\u002F",65,41]