Hacking doesn’t look the same as it used to. While organizations have invested heavily in protecting networks, endpoints and applications, attackers are increasingly finding ways to bypass those defenses altogether by going straight for users’ identities.
In fact, Palo Alto Networks’ Unit 42 reports that in the past year, identity-based techniques accounted for 65% of attackers’ initial access among the incidents it analyzed. Multi-factor authentication (MFA) has helped organizations strengthen their defenses, but as attackers adapt and go beyond password theft, organizations must reevaluate whether the authentication methods they rely on are equipped for today’s threat landscape.
Also Read: CIO Influence Interview with Srinivasan Panchapakesan, Chief Platform Officer at Hexaware
MFA Changed the Game — but Attackers Adapted
MFA may be effective, but considering the process itself has become the new ground zero for attacks, security leaders must recognize that not all methods provide the same level of protection.
With MFA making stolen passwords considerably less useful on their own, attackers are looking for new points of entry rather than focusing only on the credentials that initiate authentication. They’re now targeting the authentication steps being added as additional security layers, or even an authenticated session after a user has logged in. Techniques such as MFA fatigue, real-time phishing and session hijacking may vary, but they all point to the same challenge: adding another security barrier does not eliminate threats when attackers are simply shifting their focus elsewhere in the process.
For security leaders, this puts greater emphasis on how authentication is designed and what an attacker would need to compromise to defeat it. That distinction becomes especially important with widely used methods such as SMS one-time passwords (OTPs).
The Trouble with Traveling Credentials
SMS OTPs clearly show why the architecture behind an authentication method matters. They’ve also become widespread for good reason — they’re familiar, easy to deploy and don’t require users to carry an additional device. But this method relies on a credential that must travel, ultimately creating opportunities for it to be intercepted, redirected or obtained through social engineering.
SIM-swapping attacks are a great example, as taking control of a victim’s phone number can allow an attacker to receive SMS codes intended solely for that user. The underlying issue, then, is not simply that SMS is an older technology, but that possession of the code can become sufficient proof. If adding another authentication step can still leave a credential open to interception or theft, security leaders need to reconsider how that credential is protected in the first place.
Authentication’s “Less Is More” Moment
As attackers find new workarounds for existing security measures, organizations should rethink where the credential lives and how users prove their identities, rather than just adding more steps to the authentication process. Hardware-based authentication is one way to make that shift, as it can keep cryptographic credentials secure within the device itself rather than risk interception while traveling.
Hardware security keys already apply this idea by providing a phishing-resistant way to authenticate users. However, issuing another physical device can create separate challenges at the enterprise scale — such as distributing them across the enterprise and managing replacement needs that may arise. That said, organizations should be open to securing hardware their employees already carry.
The SIM or eSIM inside a mobile device is a prime example. Instead of sending a code that can potentially be intercepted along the way, SIM-based authentication keeps the information used to verify identity within the SIM itself. This also matters in a SIM-swapping attack — while an attacker may be able to take control of a phone number and redirect SMS messages, the cryptographic private key remains protected within the SIM.
Enterprises are already beginning to adopt this model as the threat landscape becomes more complex. Hirsch, for example, recently added SIM-based authentication known as SecureSIM™ alongside its existing hardware-key and credential-based options, which uses the SIM or eSIM already present in an employee’s smartphone as the hardware foundation. This approach lets organizations optimize the technology they already have rather than needing to continually add more codes, steps and devices to keep pace with attackers.
Looking Beyond the MFA Checkbox
As attackers continue to adapt, simply having MFA in place can no longer be the end goal. Security leaders need to look beyond whether an additional authentication step exists and consider how resistant the method itself is. Where does the credential live? Can it be intercepted, redirected or obtained through social engineering? What happens if a password is already compromised? And ultimately, what would an attacker need to defeat the authentication process altogether?
Answering those questions requires looking at authentication as part of the organization’s broader security architecture rather than just another box to check. Incorporating an additional authentication step may strengthen security, but it doesn’t necessarily solve the issue and can also introduce other points in the authentication process that attackers may target.
Security strength cannot be the only consideration. CIOs are responsible for technology that has to work across an entire organization, which means authentication must also be practical to deploy, manageable at scale and simple enough that security is not at the expense of user experience. Hardware-based approaches can help strike that balance by strengthening authentication without necessarily adding more work for users.
Ultimately, stronger authentication should not simply mean asking users to prove their identities in more ways. As identity is increasingly targeted by attackers, the priority should be making that proof harder to steal, reproduce or bypass.
About The Author Of This Article
Ran Ben-David is the founder and CEO of Unibeam.
About Unibeam
Unibeam is a digital identity company that uses SIM and eSIM as a hardware-backed trust anchor to combat AI-driven fraud, working with global carriers, governments, and enterprises to stop impersonation, account takeover, and synthetic identity attacks at scale.
Catch more CIO Insights: The Overlooked Security Risk Behind Enterprise AI Rollouts
[To share your insights with us, please write to psen@itechseries.com ]
