Phishing-resistant MFA: why TOTP is no longer enough
NEO Campus Editorial20 January 20266 min read
Adversary-in-the-middle phishing kits proxy TOTP and SMS codes in real time. Only phishing-resistant factors stop them.
Passkeys and FIDO2
Hardware-bound credentials cannot be replayed against a phishing site. Roll them out to admins first.
Conditional access
Combine device trust, geolocation, and risk scoring to block suspicious sign-ins even when credentials are valid.
Recovery paths matter
A strong front door with a weak recovery process is no stronger than the recovery process.
