Key takeaway
Passwords, SMS codes, and standard push notifications are vulnerable to reverse proxies and AI-generated attacks. Phishing-resistant authentication helps prevent credential theft by cryptographically binding every sign-in attempt to the verified application domain. Okta helps customers build phishing-resistant identity security through stronger authentication, secure defaults, and threat protection.
Passwords have long been an insufficient form of account protection. Now attackers routinely bypass push notifications, SMS, and one-time passwords, too. As AI makes it easier to create convincing, targeted phishing campaigns, attackers can steal or relay credentials in real time, take over user accounts, and gain access to the applications, data, and privileges those identities can reach. They combine phishing emails, voice calls, and live credential relays to capture credentials and use them before a victim realizes what happened. Research by Okta and Yubico found that 44% of surveyed organizations reported experiencing an AI-driven phishing attack.
Phishing-resistant authentication uses cryptographic methods that bind authentication to the legitimate service a user intends to access. This prevents users from presenting credentials to a fake service and makes those credentials ineffective in real-time relay attacks.
Okta is making phishing resistance easier to adopt and more consistent by default, so organizations can better protect critical applications, data, and privileged access from account takeover. Our goal is to help every customer build a stronger identity security baseline with phishing-resistant authentication, more secure access policy defaults, and threat-informed protection against active attacks. Okta helps security teams reduce risk while giving their workforce a practical path to more secure access.
Okta is making phishing-resistant capabilities easier to implement
Customers should not need to build a custom security program to reduce their exposure to phishing. They need a practical path away from passwords and other methods vulnerable to phishing.
Okta provides multiple paths for organizations to adopt phishing-resistant authentication based on their environments and priorities:
- Okta FastPass: Device-bound, passwordless authentication is available to customers using Okta Identity Engine
- Out-of-the-box Passkeys: Now available without requiring a multi-factor authentication (MFA) add-on
This expansion reflects our commitment to making phishing-resistant authentication broadly accessible to Okta customers. Together, these give organizations more ways to adopt phishing-resistant authentication across priority users and applications, without requiring every part of the environment to change at once.
Okta also plans to make phishing-resistant methods easier for users to recognize and choose, while reducing emphasis on more phishing-susceptible alternatives. We will also help admins identify where their policies and configurations can be upgraded to enforce phishing-resistant authentication.
This gives security teams clearer visibility into their current posture and more confidence that they are moving priority users and applications toward phishing-resistant authentication.
Stronger defaults will help customers start from a better baseline
Defaults determine the security posture you inherit as your environment grows. If a new application policy begins with phishing-susceptible methods, security teams must find and fix that gap later.
Okta makes phishing-resistant authentication the default starting point for new application sign-on policies. Administrators begin with a policy designed to resist unauthorized access and can make deliberate exceptions when their environment requires them.
Okta also plans to make it more visible when an administrator creates or edits a policy that does not require phishing-resistant authentication. This helps teams spot policy choices that could leave applications vulnerable to compromise, so organizations can maintain a more consistent access-policy posture as they add applications and users.
Coming soon: Extended protection against active phishing campaigns
Phishing-resistant authentication helps prevent attackers from stealing and reusing credentials. But when Okta identifies infrastructure associated with an active phishing campaign, organizations also need a way to respond before the activity affects their environment.
In the next few months, Okta plans to introduce new protections that use high-confidence indicators of compromise (IOCs) to help detect and limit known malicious activity during authentication.
These protections bring together signals from Okta Threat Intelligence, identity-focused detections, and the Identity Threat Protection Risk Engine. Okta research found that 83% of malicious indicators it identified had not been previously detected elsewhere.
These planned protections include:
- Okta Threat Intelligence, which identifies high-confidence signals associated with active phishing campaigns
- Identity-focused detections, including attacker infrastructure that may not yet appear in public threat sources
- The Identity Threat Protection Risk Engine, which is designed to evaluate that risk during an authentication event
For customers with identities that cannot yet use phishing-resistant MFA, these planned protections can provide an additional layer of identity security. By applying high-confidence threat intelligence during authentication, Okta can help identify activity associated with known malicious infrastructure and limit the impact of a potential account takeover.
Okta customers: How to migrate to phishing-resistant authentication
Every organization has a different mix of applications, users, and security requirements. Moving to phishing-resistant authentication takes planning, but customers can make meaningful progress without changing everything at once:
- Verify Identity Engine readiness: Confirm you use Okta Identity Engine, which enables phishing-resistant controls at the application level.
- Audit authentication vectors: Review authentication methods used for workforce and privileged access.
- Enforce phishing resistance on high-risk apps: Prioritize critical applications that still allow phishing-susceptible authentication methods.
- Deploy device-bound passkeys: Adopt passkey and phishing-resistant authentication for priority user groups.
- Phase out susceptible fallbacks: Reduce and retire phishing-susceptible fallback methods as deployment matures.
Built-in tools to guide your phishing-resistance journey
For eligible Okta Workforce Identity customers in commercial cells, evaluating your readiness is already seamless: your personalized Security Snapshot automatically generates a daily-updated phishing-resistance checklist directly inside the Okta Customer Success Hub. This built-in guidance is part of how we eliminate blind spots, giving security teams actionable clarity to assess their posture and prioritize next steps. Contact your Okta account team for help building an adoption plan.
Any mention in this publication of solutions, features, functionalities, certifications, authorizations, or attestations that are not currently generally available (including planned Q4 protections) may not be delivered or obtained on time or at all. Okta assumes no obligation to deliver on such items, and readers should not rely on them to make purchase decisions. These materials are intended for general informational purposes only and are not intended to be legal, privacy, security, compliance, or business advice. Okta product outcomes vary by implementation, configuration, and environment. © 2026 Okta, Inc. and/or its affiliates.
