Authentication
Passkeys, FIDO, MFA and how people and machines prove who they are. What is shipping, what is breaking, and what it means for enterprise authentication rollouts.
identity attacks · authentication
Three Black Hat papers broke passkey deployments. None of them broke passkeys.
Pass-the-Passkey, Pass-Ta-Key and a Windows Hello abuse technique all reached privileged access without ever touching a private key.
identity attacks · authentication
Entra ID makes passkeys the default. Attackers went for enrolment first.
Microsoft flips the default in September 2026. Okta has already documented a threat actor phoning users through a fake enrolment flow.
authentication · ai & agent identity
OpenAI will gate its most capable cyber models behind a physical key
Identity used to gate a capability rather than data. From 1 September, Trusted Access for Cyber needs a hardware-backed passkey.