Passwords died somewhere around 2022. The funeral for SMS codes happened in 2024, when the SIM swap attacks moved from the news section to the incident response binder. The survivors in 2026 sit at three: hardware keys, passkeys, certificate based auth. The choice between them runs as the choice the enterprise has been postponing for three years, and the postponement has cost enough breaches to retire the debate.
The term “phishing resistant” matters here. The MFA that sits phishing resistant runs as the MFA the phishing kit cannot defeat. The MFA that sits not phishing resistant runs as the MFA the attacker can defeat in real time, with the user watching, with the user thinking everything is fine.
What phishing resistant actually means
Three things, in roughly that order of how much each one matters. The first runs as the cryptographic binding, where the authenticator cryptographically binds the session to the origin, the attacker who proxies the phishing site cannot replay the credential, the session cannot be lifted. The second runs as the no shared secret, where the authenticator does not rely on a shared secret (the password, the code, the OTP) that the attacker can capture and replay, the authenticator relies on the public key cryptography where the private key never leaves the device. The third runs as the origin verification, where the authenticator verifies the origin (the domain, the certificate, the URL) before it releases the credential, the user cannot be tricked into authenticating to a lookalike site. The three properties together serve as what makes the MFA actually phishing resistant.
The three options that work in 2026
Three options, in roughly that order of how widely each one sits deployed. The first runs as the hardware key, the FIDO2 key, the YubiKey, the Titan key, the small device the user plugs in or taps, the key that cannot be phished because the key will not release the credential to a lookalike site. The hardware key runs as the most secure option, the highest user friction, the most common choice for the admin accounts, the developer accounts, the high value accounts. The second runs as the passkey, the FIDO2 credential stored on the device, the iCloud Keychain, the Google Password Manager, the 1Password, the passkey that the user unlocks with the biometric, the passkey that the user cannot be tricked into authenticating to the wrong site. The passkey runs as the balance of security and usability, the right choice for most users, the right choice for the consumer facing apps. The third runs as the certificate based auth, the smart card, the PIV, the CAC, the certificate that the device presents to the server, the certificate that the server validates against the PKI, the certificate that the attacker cannot phish because the certificate sits bound to the device. The certificate sits as the right choice for the federal, the defense, the high assurance environment, the choice with the highest deployment cost.
How to roll it out without breaking everything
Three moves if you are rolling out the phishing resistant MFA without breaking the business. Start with the high value accounts, because the admin accounts, the developer accounts, the executive accounts, the finance accounts run as the accounts that produce the catastrophic breach, the hardware key for those accounts gives the enterprise the biggest risk reduction for the smallest user base. Use the passkey for the broad user base, because the passkey scales, the passkey works on the phone, the passkey works on the laptop, the passkey does not require the user to carry an additional device. Keep the password as the fallback (for now), because the user will lose the key, the user will break the phone, the user will need the recovery path, the recovery path that falls back to the password runs as the recovery path the attacker will target, the password that sits long, unique, and stored in the password manager gives the user the recovery without giving the attacker the easy win. The enterprise that starts with the high value accounts, uses the passkey for the broad base, and keeps the password as the fallback serves as the enterprise that lands the phishing resistant MFA without breaking the business.
The bottom line
The phishing resistant MFA in 2026 sits at three options, all of which beat the SMS code by an order of magnitude. The hardware key for the high value accounts, the passkey for the broad user base, the password as the fallback. The enterprise that does those three moves holds the line. The one that still uses the SMS code as the primary factor does not.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
