Effective IAM starts with MFA, but ends with phishing-resistant methods and passwordless authentication, where a stolen password stops mattering at all. In practice, you roll out strong authentication, clean up permissions, and secure the account recovery process. It’s the fastest way to cut risk.
What is IAM, and why do most incidents start with identity?
IAM (Identity and Access Management) is a set of processes and technologies that answer 3 questions:
- Who is trying to gain access?
- What do they have access to, and under what rules?
- From where and under what conditions is that access granted?
In practice, most successful attacks go “through the person” and their account: phishing, session hijacking, password leaks, and permission misconfigurations. Verizon’s 2024 DBIR shows that the human element appears in a large share of breaches.
In IAM, which matters more: authentication or authorization?
Both are critical in production, but companies most often confuse the priorities.
- Authentication: confirming identity (password, MFA, passkey).
- Authorization: defining permissions (RBAC, ABAC, policies).
My experience from audits is brutally simple: you can have the best MFA in the world, but if an account has excessive permissions or access isn’t segmented, the damage after a takeover is still massive.
Which types of MFA work well, and which are risky today?
MFA is “an extra factor” alongside a password, but not every MFA method gives you the same level of security.
The most common methods and their real risks:
- SMS/email codes: vulnerable to SIM-swapping, interception, and social engineering. Fine as a transitional step, weak as a long-term standard.
- TOTP (authenticator app codes): better than SMS, but still phishable.
- Push MFA (approve on your phone): convenient, but vulnerable to “push fatigue” and prompt bombing.
- Phishing-resistant MFA: FIDO2/WebAuthn, hardware keys, passkeys. This is currently the gold standard for privileged accounts and access to critical systems.
What is phishing-resistant MFA, and why does it matter in 2025?
Phishing-resistant MFA is a method that can’t effectively be “relayed” to a fake login page, because authentication is cryptographically tied to the service’s real domain.
CISA explicitly names WebAuthn and the related FIDO2 standard as phishing-resistant solutions.
In practice, that’s the difference between:
- “the user fell for it, but nothing happened,”
and - “the user fell for it, and now we have an incident.”
What does passwordless mean, and is it the same as passkeys?
Passwordless means logging in without typing a password. You’ll most commonly encounter two models:
- Passkeys
A passkey is a cryptographic FIDO credential tied to a user’s account and device. The user logs in the same way they unlock their phone or laptop (biometrics, PIN). - Other passwordless methods
For example, Windows Hello or certificates in enterprise environments. The key requirement is that the method is phishing-resistant and has sensible recovery.
What business benefits does passwordless bring to IAM?
Passwordless isn’t just “nice UX.” In practice, it delivers three things:
- fewer password resets (real helpdesk costs go down),
- fewer successful phishing attacks (there’s no password to steal),
- a higher rate of successful logins (less friction for the user).
Microsoft has reported very high success rates for passkey logins compared to passwords, and is pushing hard toward a “passwordless by default” model for new accounts.
How do you roll out MFA step by step without killing productivity?
The safest rollout, one that has worked for me in companies ranging from 50 to 5,000 people:
- Inventory applications and login methods
Identify legacy auth (IMAP/SMTP without modern auth, old VPNs, apps without SSO). This is usually the main landmine. - SSO as the standard, not the exception
Centralize logins in your IdP wherever you can. Scattered accounts mean scattered chaos. - Pilot with high-risk groups
Start with IT, finance, admins, and leadership. Then everyone else. - Gradually raise requirements
Start with MFA for external access and risky logins, then move to full enforcement. - Cut weak methods
SMS and email as a fallback only where truly necessary, and only temporarily. - Build resilient recovery
The most common way to bypass MFA is account recovery. Recovery has to be tougher than the login itself.
How do you move from MFA to passkeys without chaos?
A good passkey rollout is an identity project, not “a toggle in a settings panel.”
A practical plan:
- Identify where passkeys make sense immediately
Privileged accounts, admin panel access, SOC, finance. - Choose a passkey model
- device-bound (strictly tied to a device),
- synchronized (synced across devices within an ecosystem).
- Take care of onboarding
Users need to know: what to do when they change phones, how backup access works, and how not to lock themselves out. - Introduce step-up authentication
Not everything needs a passkey right away. Sensitive operations can require a stronger step. - Measure and improve
Track adoption, number of tickets, login time, and the number of phishing attempts that succeeded.
How do you secure privileged accounts (PAM) on the path from MFA to passwordless?
If you only get one thing right, get it right for admins.
A standard that genuinely raises security:
- separate admin and user accounts,
- phishing-resistant MFA for admins (FIDO2/WebAuthn),
- JIT/JEA (access granted for a limited time and a specific task),
- logged and auditable admin sessions,
- restricted network access to management panels.
This is the area where passwordless makes the most sense, because the risk is greatest.
What are the most common mistakes in IAM implementations?
From implementation and incident response experience:
- MFA enabled but not enforced (users “set it up eventually”),
- no blocking of legacy auth,
- push MFA without policies (no protection against prompt bombing),
- weak account recovery (the helpdesk can be talked into anything),
- no visibility (scattered logs, no event correlation),
- no least-privilege rules (a compromised account can do too much).
How do you measure whether IAM is actually working?
If you’re not measuring it, you’re just believing it.
The most practical KPIs:
- share of accounts with MFA and with phishing-resistant MFA,
- number of blocked high-risk login attempts,
- number of password resets per 100 users,
- number of incidents resulting from account takeover,
- time to grant and revoke permissions (joiner, mover, leaver),
- number of privileged accounts and how long they stay active.
Sources
- NIST SP 800-63B (Digital Identity Guidelines, authentication requirements): (NIST Pubs)
- CISA, Implementing Phishing-Resistant MFA (WebAuthn/FIDO2 as phishing-resistant): (CISA)
- CISA, Hybrid Identity Solutions Guidance (assessment of WebAuthn/FIDO2 as phishing-resistant): (CISA)
- FIDO Alliance, Passkeys (definition and mechanism of passkeys): (FIDO Alliance)
- Microsoft Security Blog, passkeys and rollout (adoption context and the direction toward passwordless): (Microsoft)
- The Verge, Microsoft passwordless by default and login success statistics: (The Verge)