Authentication & MFA
Most SaaS apps cannot locally mandate phishing-resistant MFA
A study of 95 SaaS apps reveals most cannot locally mandate passkeys, forcing firms to rely on identity providers and expensive enterprise plans.
Customer Identity
Customer identity refers to the systems and processes used to manage the digital identities of clients and end-users, focusing on authentication, account security, and the prevention of unauthorized access.
Understand the story
Follow this story through dated reporting and the underlying records. Evidence labels distinguish documented findings, attributed reporting, disputed accounts and claims that remain unverified. Start with the background reports below, then read the latest developments.
Start with these reports
Check the evidence
Primary documents
Latest reporting
More on Customer Identity
Incidents & Breaches
Attacker bypasses MFA at 79 organizations using token spraying
An attacker used "token spraying" to bypass MFA at 79 organizations, registering rogue devices and replacing MFA methods to survive password resets.
Authentication & MFA
FIDO2 passkeys block session token theft
Organizations are shifting to phishing-resistant passkeys as attackers use reverse proxies to steal session tokens and bypass traditional MFA in Microsoft 365 environment...
Incidents & Breaches
EU member states required to provide digital identity wallets by 2026, says report
EU payment providers face a 2026 deadline to integrate digital identity wallets amid new rules shifting fraud liability from consumers to providers.
Incidents & Breaches
Wiz reports actor using ARTEX AI agent targeted identity providers
Security firm Wiz identified Storm-0940 using an autonomous penetration-testing framework to probe Okta, Entra ID, and Cognito across software vendors and financial insti...
Timeline 6 reports
- 2026
- Wiz reports actor using ARTEX AI agent targeted identity providers
- EU member states required to provide digital identity wallets by 2026, says report
- FIDO2 passkeys block session token theft
- Attacker bypasses MFA at 79 organizations using token spraying
- FBI reports $262 million in losses from account takeover fraud
- Most SaaS apps cannot locally mandate phishing-resistant MFA