INTEL-44: The Basics Are Working

Fri, 30 Oct 2026 00:00:00 +0000

The INTEL

Some good news from Microsoft’s 2026 Digital Defense Report: password attacks are down 26% year over year. Microsoft calls it “strong evidence that security measures such as MFA and passkeys are forcing attackers to pivot to other approaches to achieve access to high-value targets.”

The controls work, so attackers are going around them. Microsoft names where they’re going: “new-hire onboarding and account recovery,” the side doors that “rely on weaker credentials like SMS or email-based one-time passcode (OTP).” It also saw the share of adversary-in-the-middle phishing and token theft, techniques built to get past MFA, more than double in the first six months of 2026. That share is still comparatively small, Microsoft notes, but “it shows the direction of travel.”

Passkeys on FIR Risk Advisory | Risk Intelligence. Engineered.

INTEL-44: The Basics Are Working

The INTEL