Phishing-Resistant Authentication in the Age of AI

Co-Presenter

What This Talk Is About

AI is making phishing faster, cheaper, and more convincing — which means passwords and SMS-based MFA are becoming liabilities, not security controls. This session walks through what that shift actually looks like in the field: real attack patterns, not abstractions. We cover why phishing-resistant authentication (FIDO2, hardware keys, passkeys) is the only practical floor in 2026, and how to evaluate which approach fits your environment without a five-year PKI project.

Three Things You'll Leave With

1. 1

   How AI is concretely changing the threat surface for credential attacks

   AI-generated spear-phishing now bypasses detection at scale. Real-world examples of what this looks like — adversarial prompt injection, deepfake voice MFA bypass, AiTM proxy kits — and why your current controls weren't built for this.

2. 2

   Why phishing-resistant MFA is the floor, not the ceiling

   Phishing-resistant is a binary: either the credential can be stolen over the network or it can't. TOTP and push notifications don't make the cut. In 2026, any identity program that calls SMS OTP “MFA” is behind. We'll explain what comes after the floor.

3. 3

   A decision framework for FIDO2 / passkeys / hardware keys

   Not every environment deploys hardware keys the same way. We'll walk through a lightweight framework for matching FIDO2 variants to use-case constraints: device-bound vs. synced passkeys, shared workstations, high-assurance regulated environments, and where hardware tokens still win.