Identity Security Explained: MFA, Passkeys, Account Takeover and Zero Trust

Identity security is the practice of making sure the right person, device or software identity receives the right level of access to the right resource at the right time. It includes passwords, multifactor authentication, passkeys, account recovery, session protection, privileged access, device trust and the policies that determine what someone can do after successfully signing in.

That sounds simple. Modern cyberattacks show why it is not.

Many attackers no longer need to “break into” a system in the traditional sense. If they can steal a valid password, capture a session cookie, trick a user into approving an authentication request or take control of an account-recovery process, they may appear to the system as a legitimate user.

Microsoft’s latest Digital Defense research found that identity-based attacks increased 32% during the first half of 2025, while more than 97% of identity attacks were password attacks. The company’s wider research also shows how infostealer malware is increasingly used to collect passwords and browser-session information that criminals can sell to other attackers.

The financial consequences can be substantial.

The FBI said in November 2025 that its Internet Crime Complaint Center had received more than 5,100 complaints involving account-takeover fraud since January 2025, with reported losses exceeding $262 million. Those cases involved financial, payroll and health-savings accounts and frequently began through impersonation, phishing or social engineering.

This is why identity security has become one of the most important parts of modern cybersecurity.

For the broader framework around malware, phishing, ransomware, privacy, network security and incident response, start with The News Ink’s Cybersecurity Explained: Complete Guide.

Identity Security at a Glance

Security control	Main purpose	Major threat reduced
Unique passwords	Prevent password reuse	Credential stuffing
Password manager	Generate/store strong credentials	Weak and reused passwords
MFA	Require additional authentication	Stolen passwords
Passkeys	Replace passwords with cryptographic credentials	Phishing and password theft
Session protection	Protect authenticated sessions	Cookie/token theft
Conditional access	Evaluate context before granting access	Suspicious logins
Least privilege	Restrict what accounts can do	Damage after compromise
Privileged access controls	Protect administrator identities	High-impact account takeover
Zero Trust	Remove implicit trust	Lateral movement and excessive access
Secure recovery	Protect password/account reset	Help-desk and recovery fraud

Identity security therefore starts before login and continues long after authentication succeeds.

What Is Identity Security?

A digital identity represents a person, device, service or application inside a technology environment.

For a human user, identity may include:

• username;
• email address;
• employee ID;
• authentication credentials;
• assigned roles;
• group memberships;
• device information;
• and access permissions.

Organizations also have non-human identities.

Applications use service accounts.

Cloud workloads use credentials.

APIs use tokens and keys.

Automation systems may need access to databases or internal applications.

Identity security therefore has two fundamental jobs:

prove who or what is requesting access, and determine what that identity is allowed to do.

These functions are related but different.

Authentication vs Authorization vs Identity Proofing

Term	Main question	Example
Identity proofing	Who are you in the real world?	Verifying documents during account enrollment
Authentication	Can you prove control of this digital identity?	Using a password and security key
Authorization	What are you allowed to access?	Giving an employee access to payroll but not security administration
Session management	Should access continue?	Ending a session after suspicious behavior
Account recovery	How can access be restored safely?	Recovering an account after losing a device

NIST’s current Digital Identity Guidelines, SP 800-63 Revision 4, cover these areas through separate guidance for identity proofing, authentication and federation. The July 2025 revision also added new consideration for fraud, forged media such as deepfakes and syncable authenticators including passkeys.

That broader lifecycle matters.

An account protected by excellent MFA can still become vulnerable if its password-reset process can be manipulated through a weak customer-support channel.

Identity security is only as strong as the weakest route into the account.

Why Passwords Remain a Major Security Problem

Passwords have several structural weaknesses.

People forget complex passwords.

They therefore reuse them.

They choose predictable patterns.

Attackers obtain credentials from data breaches.

Phishing pages can capture them.

Infostealer malware can extract credentials stored in browsers.

Criminals can then attempt stolen username-password combinations against other services.

Several common attacks exploit these weaknesses.

Password Spraying

A password spray attack tries a small number of common passwords against many accounts.

Instead of repeatedly attacking one username and triggering lockout protections, an attacker spreads attempts across a large population.

Microsoft says password spray attacks represented the overwhelming majority of the identity attacks it observed in its latest defense research.

Credential Stuffing

Credential stuffing uses previously stolen usernames and passwords against other services.

For example, somebody uses the same email and password for a shopping site and an email account.

The shopping service is breached.

Criminals obtain the credential pair.

They then try it against email, cloud storage, social platforms and financial services.

A password manager reduces this threat because every account can have a different random password.

The News Ink’s password manager guide explains how unique passwords limit the damage when one service suffers a breach. The URL is verified in the site’s cybersecurity cluster.

Phishing

Phishing solves another problem for attackers: instead of guessing the password, convince the owner to provide it voluntarily.

A fake Microsoft, Google, bank or payroll login page can look nearly identical to the real service.

The News Ink’s phishing warning signs guide covers this attack in greater depth.

This is why identity security has increasingly moved beyond password-only authentication.

What Is Multifactor Authentication?

Multifactor authentication, or MFA, requires evidence from more than one authentication factor.

The traditional factor categories are:

Something you know
A password or PIN.

Something you have
A phone, authenticator, security key or device containing a cryptographic key.

Something you are
A biometric characteristic such as a fingerprint.

NIST makes an important distinction: two passwords are not two factors because both are examples of “something you know.”

A typical MFA login might therefore require:

password + authenticator app

or:

password + hardware security key

If an attacker steals only the password, the second factor can prevent account takeover.

The News Ink’s dedicated multifactor authentication guide provides a deeper explanation of MFA setup and account protection.

Not All MFA Is Equally Secure

One of the most important identity security lessons is that “MFA enabled” does not describe the actual strength of the authentication method.

Authentication method	Relative security	Phishing resistant?
Password only	Weak	No
Password + SMS code	Better	No
Password + email code	Better	No
Password + authenticator OTP	Stronger	No
Push approval	Stronger	Usually No
Number-matching push	Better push security	No
FIDO security key	Very strong	Yes
Passkey	Very strong	Yes

CISA says any MFA is better than no MFA, but recommends organizations move toward phishing-resistant MFA. It identifies FIDO/WebAuthn as the widely available phishing-resistant standard and recommends number matching when stronger FIDO authentication cannot yet be deployed.

The important distinction is how the authentication mechanism interacts with the website.

A one-time code can still be typed into a fake page.

The attacker can immediately relay it to the genuine service.

NIST therefore says authentication methods requiring users to manually enter OTP outputs are not phishing resistant.

How Attackers Can Defeat Weak MFA

MFA dramatically improves account security, but weaker implementations can still be attacked.

MFA Fatigue

An attacker obtains a password and repeatedly sends push-authentication requests.

The victim eventually approves one simply to make the notifications stop.

Number matching reduces this problem by requiring the user to enter or select information associated with the actual login.

Real-Time Phishing

A fake login website asks for the password.

The attacker sends those credentials to the genuine site.

The genuine site requests an OTP.

The fake site asks the victim for that OTP.

The attacker relays the code immediately.

The user believes they have successfully logged in.

The attacker receives the real authenticated session.

SIM-Related Attacks

Authentication based on SMS depends partly on control of the telephone number.

If criminals successfully transfer or hijack the number, SMS authentication can become vulnerable.

Help-Desk Social Engineering

An attacker may call support and pretend to be an employee who lost a phone.

If support resets MFA without sufficiently verifying identity, the attack bypasses the strongest authentication technology through a weaker recovery process.

This is why identity security must protect enrollment, login, recovery and reset processes together.

Passkeys Explained

Passkeys are designed to replace passwords with cryptographic credentials.

Instead of a secret that a person types into a website, passkeys use a cryptographic key pair.

One component is public and can be stored by the online service.

The private key remains protected by the user’s device or credential provider.

When the person signs in, the device cryptographically proves possession of the correct private key.

The user may unlock that passkey using:

• fingerprint;
• face recognition;
• device PIN;
• or another local unlock method.

The biometric is normally used to unlock the credential on the device rather than being sent to the website.

The FIDO Alliance describes passkeys as FIDO credentials using public-key cryptography to provide phishing-resistant passwordless authentication.

Why Passkeys Resist Phishing

A password is transferable.

If you enter it into a fake website, the criminal now knows it.

A passkey works differently.

The credential is cryptographically associated with the legitimate service.

A fake site pretending to be the real service cannot simply ask you to reveal the private key.

FIDO explains that each passkey is bound to the specific online service for which it was created. Authentication therefore occurs with the legitimate relying party rather than an unrelated phishing domain.

This changes the security model from:

“Can the user notice the fake website?”

to:

“Can the authentication protocol prevent the fake website from obtaining reusable credentials?”

That is a significant improvement.

Passkeys Are Becoming Mainstream

Passkeys are no longer a small experiment.

FIDO’s 2026 global research estimates that 5 billion passkeys are now in active use.

In a survey of 11,000 adults across ten countries, FIDO reported:

• 90% were familiar with passkeys;
• 75% had enabled them on at least some accounts.

Its separate workforce research found 68% of surveyed organizations were deploying, piloting or rolling out passkeys for employees.

These are FIDO-sponsored survey results rather than universal adoption measurements, but they show how quickly passkeys are moving into mainstream authentication.

Synced Passkeys vs Device-Bound Passkeys

Not every passkey is stored in exactly the same way.

Synced Passkeys

A synced passkey can be securely synchronized through a credential provider to multiple trusted devices.

The advantage is convenience and recovery.

If a person replaces a phone, their credentials can remain available through the protected account ecosystem.

Device-Bound Passkeys

A device-bound passkey remains tied to a particular security device or hardware key.

This creates stronger assurance in some enterprise and high-security environments but can require more deliberate recovery planning.

FIDO says device-bound hardware-backed security keys can provide the highest assurance, while synced passkeys provide strong phishing resistance with greater convenience.

For ordinary users, synced passkeys may provide a powerful combination of security and usability.

For highly privileged administrators, organizations may choose more tightly controlled hardware-backed credentials.

Does a Passkey Mean MFA Is No Longer Needed?

This depends on the security architecture.

A passkey can itself provide multifactor authentication when possession of the cryptographic credential is combined with a local activation factor such as a PIN or biometric.

This is one reason passkeys can replace some older flows such as:

password + SMS code

or:

password + authenticator code

The important point is not counting the number of screens during login.

It is determining what security properties the authentication mechanism provides.

Phishing resistance is particularly important.

What Is Account Takeover?

Account takeover occurs when somebody gains unauthorized control of another person’s legitimate online account.

Targets can include:

• email;
• bank accounts;
• payroll;
• cloud services;
• social media;
• business systems;
• cryptocurrency exchanges;
• healthcare accounts;
• and administrator accounts.

Once an attacker controls the identity, they may be able to perform legitimate-looking actions.

That makes identity compromise particularly dangerous.

The attacker may not need malware on every system.

They may simply use valid access.

The FBI says criminals conducting financial account-takeover schemes frequently impersonate financial institutions through text messages, calls, emails and fraudulent websites to obtain credentials and authentication codes.

Common Account-Takeover Paths

Attack path	What the attacker obtains
Phishing	Password and possibly OTP
Credential stuffing	Reused username/password
Password spray	Weak/common password
Infostealer malware	Passwords, cookies and tokens
MFA fatigue	Fraudulent approval
Support impersonation	Account reset
SIM attack	Control of phone-based authentication
Session hijacking	Existing authenticated session
OAuth abuse	Permission through connected application

Understanding these paths explains why identity security cannot be reduced to password length.

Session Cookies and Tokens: The Threat After Login

Authentication is only the beginning of an online session.

After successful login, many services issue a session cookie or token.

This tells the service:

“This user has already authenticated.”

Without this mechanism, users would need to enter credentials on every page.

But session tokens also become valuable targets.

The FBI has warned that criminals can steal “Remember Me” cookies and use them to access email accounts without needing the username, password or MFA challenge again.

Infostealer malware makes this threat even more important.

Microsoft reports that modern infostealers can collect account information and browser-session tokens at scale and sell them through criminal markets.

This means a strong MFA setup does not automatically protect a session after that MFA has already been completed.

How to Protect Sessions

Session security can include:

• shorter session lifetimes for sensitive applications;
• reauthentication before critical actions;
• device binding;
• suspicious-login detection;
• token revocation;
• endpoint protection;
• continuous access evaluation;
• and requiring new authentication after major risk changes.

Users should periodically review devices and active sessions attached to important accounts.

If an account is compromised, changing the password alone may not always be enough.

Existing sessions may also need to be terminated.

Email Is Your Most Important Identity Account

For many individuals, email is effectively the master recovery account.

A compromised email inbox may allow attackers to reset passwords for:

• social media;
• cloud storage;
• shopping;
• financial platforms;
• work applications;
• and other online services.

Email therefore deserves some of the strongest identity security available.

Use:

• a unique password or passkey;
• phishing-resistant MFA where supported;
• secure recovery methods;
• login alerts;
• and regular review of active sessions.

An attacker who controls email can often attack other identities from inside the victim’s normal digital life.

Account Recovery Is Part of Identity Security

Strong authentication is useless if recovery is dramatically weaker.

Suppose an account uses a hardware security key.

An attacker cannot successfully phish that credential.

But then the attacker contacts support and says:

“I lost my security key and phone. Please reset my account.”

If customer support relies only on easily discovered personal information, the attacker may still succeed.

Secure recovery should be designed as carefully as login.

NIST’s current digital identity guidance emphasizes supporting recovery while maintaining the appropriate level of identity assurance.

Organizations should also remember that deepfake audio and synthetic identification can make remote identity verification harder.

Privileged Accounts Require Stronger Protection

Not every identity creates the same risk.

A standard employee account might access email and a few applications.

An administrator can potentially:

• create users;
• reset credentials;
• change security settings;
• access sensitive systems;
• disable protections;
• or grant additional privileges.

Privileged identities therefore require stronger controls.

Good practice can include:

• separate administrator accounts;
• phishing-resistant MFA;
• device restrictions;
• just-in-time privilege elevation;
• approval workflows;
• activity logging;
• and limiting standing administrator access.

The principle is simple:

the more damage an identity can cause, the more strongly it should be protected.

What Is Zero Trust?

Zero Trust is a security model based on removing automatic or implicit trust.

It does not mean blocking everyone.

It means access should not be trusted simply because someone is:

• inside the office;
• connected to the corporate network;
• using a company laptop;
• or successfully authenticated hours earlier.

NIST’s Zero Trust Architecture explains that no implicit trust should be granted to a user or asset solely because of network location or ownership. Authentication and authorization should occur before access to protected resources is established.

Traditional security often imagined a castle:

outside = dangerous

inside = trusted

Cloud services, remote work, SaaS applications, contractors and mobile devices have made that model increasingly weak.

Zero Trust instead protects individual resources and continuously evaluates access.

Identity Is Central to Zero Trust

NIST’s later Zero Trust guidance describes a major shift from relying on network parameters such as IP addresses and network segments toward decisions based increasingly on user, service and application identities.

CISA’s Zero Trust Maturity Model similarly places Identity as one of its major pillars.

In more mature Zero Trust environments, CISA recommends phishing-resistant MFA and repeated validation of identity rather than trusting a user indefinitely after initial login.

A Zero Trust decision might consider:

• Who is the user?
• What device are they using?
• Is the device healthy?
• Where is the login coming from?
• What application is being requested?
• How sensitive is the data?
• Is this normal behavior?
• Has the risk changed since the session began?

The result may be:

allow

deny

require stronger authentication

or:

grant limited access

Zero Trust Is Not “Never Trust, Always Verify” as a Single Login Rule

The phrase “never trust, always verify” is useful shorthand, but Zero Trust is broader.

A company does not simply add MFA and become Zero Trust.

A mature architecture can include:

• strong identity;
• device security;
• least privilege;
• segmentation;
• application-level authorization;
• continuous evaluation;
• logging;
• analytics;
• workload identity;
• and data-centric controls.

The goal is to reduce the amount of trust granted automatically.

Least Privilege Limits Account-Takeover Damage

Imagine two compromised accounts.

Account A can access every company file and administrative tool.

Account B can access only the three systems required for its job.

The same stolen credential creates dramatically different risk.

This is the principle of least privilege.

Users, devices and applications should receive only the permissions required to perform legitimate tasks.

NIST’s current Zero Trust implementation guidance also discusses “just enough” and “just in time” access, where elevated privileges exist only when needed rather than remaining permanently available.

This does not prevent account takeover.

It limits what the attacker can do afterward.

Machine Identities Matter Too

Modern businesses can have enormous numbers of non-human identities.

Examples include:

• cloud workloads;
• service accounts;
• APIs;
• containers;
• automated scripts;
• applications;
• and AI agents.

These identities also need authentication and authorization.

A leaked API key can be as dangerous as a stolen employee password.

Machine identities should therefore have:

• limited permissions;
• secret rotation;
• short-lived credentials where possible;
• monitoring;
• clear ownership;
• and automatic revocation when no longer required.

Zero Trust increasingly applies to people and software identities together.

Identity Security for Individuals

Most people do not need enterprise identity-management software.

They do need a strong personal identity strategy.

Protect Email First

Email frequently controls account recovery for everything else.

Use Passkeys When Available

Passkeys remove the reusable password and provide strong phishing resistance.

Otherwise Use Unique Passwords

Never reuse important credentials.

Turn On MFA

Use the strongest method the service supports.

Prefer passkeys or security keys where appropriate, followed by strong authenticator methods.

Save Recovery Codes Safely

Do not discover during an emergency that your only recovery method was stored on the lost device.

Review Active Sessions

Remove unknown devices and old sessions.

Protect Your Phone Number

A phone number can play a role in password resets and SMS authentication.

Question Unexpected Security Calls

Banks and support teams should be independently verified before you provide sensitive information.

Personal Identity Security Checklist

Action	Priority
Secure main email account	Critical
Use unique passwords	Critical
Enable MFA	Critical
Move important accounts to passkeys where available	High
Store recovery codes securely	High
Review active devices and sessions	High
Remove unused connected apps	Medium
Monitor login alerts	High
Keep devices malware-free	Critical
Update recovery phone/email information	High

Identity Security for Businesses

Organizations face a larger challenge because thousands of identities can exist across cloud applications, remote devices, contractors and automated systems.

A mature program should include several layers.

Central Identity Management

Employees should be provisioned and removed through controlled processes.

When someone leaves the organization, their access should not remain active across forgotten applications.

Single Sign-On

SSO can reduce the number of passwords employees must manage.

But the central identity provider then becomes extremely important and needs strong protection.

Phishing-Resistant MFA

High-risk users and administrators should receive priority.

CISA specifically recommends organizations plan a move toward FIDO-based authentication.

Conditional Access

A valid password may still require additional checks if:

• the device is unmanaged;
• the geographic location is unusual;
• behavior appears suspicious;
• or the requested resource is highly sensitive.

Privileged Access Management

Administrative access should be restricted, monitored and preferably temporary.

Session Monitoring

Security should continue after successful login.

Secure Offboarding

Accounts, tokens, devices and application access should be disabled promptly when employment or contractual relationships end.

What to Do After an Account Takeover

Move quickly.

1. Use a Trusted Device

Do not reset credentials from a computer you suspect contains infostealer malware.

2. Change the Password

Create a new unique credential.

3. Revoke Existing Sessions

Use the account’s “sign out everywhere” or equivalent feature where available.

4. Review MFA Methods

Remove unfamiliar phone numbers, authenticators, passkeys or security keys.

5. Check Recovery Information

Attackers may add their own email or phone number.

6. Review Connected Applications

Revoke unknown OAuth or third-party app access.

7. Check Account Changes

Look for forwarding rules, filters, new payees, changed bank details or unauthorized messages.

8. Secure Other Accounts

If the old password was reused, change those accounts immediately.

9. Check for Malware

Credential theft may have originated from an infected device.

10. Report Financial Fraud Immediately

The FBI advises victims of financial account takeover to contact their financial institution quickly because stolen funds can be moved rapidly.

If the compromise exposed personal, employee or customer information, continue with The News Ink’s data breach response guide.

Common Identity Security Myths

Myth	Reality
“A long password is enough.”	Passwords can still be phished or stolen
“Any MFA stops phishing.”	OTP and SMS methods can still be relayed
“Passkeys send my fingerprint to websites.”	Biometrics normally remain on the device
“MFA means session theft is impossible.”	Stolen authenticated cookies can bypass a new login
“Zero Trust means employees are never trusted.”	It removes automatic trust and evaluates access
“Only human accounts matter.”	Applications and service accounts also require identity controls
“Changing my password ends every attacker session.”	Active tokens may also need revocation
“Account recovery is separate from security.”	Recovery is another authentication path

Frequently Asked Questions

What is identity security?

Identity security protects digital identities and controls how people, devices and applications authenticate and access resources. It includes passwords, MFA, passkeys, authorization, account recovery, session protection, privileged access and Zero Trust controls.

Is MFA enough to stop account takeover?

MFA provides strong protection, but not every method is equally resistant to attack. SMS, OTP and push-based authentication can still be targeted by phishing or social engineering. Phishing-resistant FIDO authentication provides stronger protection.

What is the safest type of MFA?

For widely available authentication, CISA recommends phishing-resistant FIDO/WebAuthn methods. Passkeys and hardware security keys use this approach.

Are passkeys safer than passwords?

Passkeys offer important security advantages because there is no reusable password for an attacker to steal and the cryptographic credential is bound to the legitimate service. This makes passkeys resistant to common phishing and credential-stuffing attacks.

Can hackers bypass MFA?

Some forms can be bypassed through real-time phishing, MFA fatigue, compromised recovery procedures or stolen authenticated session cookies. Strong phishing-resistant authentication and session security reduce these risks.

What is account takeover?

Account takeover is unauthorized control of a legitimate account. Criminals may obtain access through phishing, reused passwords, infostealer malware, authentication-code theft, social engineering or session hijacking.

What is Zero Trust in simple words?

Zero Trust means access is not automatically trusted simply because a user or device appears to be inside a network or has previously authenticated. Identity, device state, permissions and other risk signals are evaluated before and during access.

Does Zero Trust replace MFA?

No. MFA is one component that can support Zero Trust. A complete Zero Trust architecture also involves authorization, least privilege, device security, application controls, monitoring and continuous evaluation.

Should I use a password manager if I have passkeys?

Yes, if you still have accounts requiring passwords. Many people will use passkeys and passwords together during the transition toward passwordless authentication.

What should I secure first?

For most individuals, the primary email account should receive the strongest protection because it often controls password recovery for many other services.

Conclusion

Identity security has become one of the central battlegrounds of cybersecurity.

Attackers do not always need to defeat a firewall or exploit complicated software.

Sometimes they only need a valid identity.

A reused password can be credential-stuffed.

A weak password can be sprayed.

A phishing page can collect a password and one-time code.

Infostealer malware can steal credentials and browser-session tokens.

A convincing caller can trick someone into resetting MFA.

A stolen session cookie can potentially let an attacker reuse an authenticated session.

The answer is not one security product.

It is stronger identity architecture.

Use unique credentials.

Deploy MFA.

Move important accounts toward phishing-resistant passkeys or security keys.

Protect sessions as well as logins.

Secure recovery processes.

Limit privileges.

Monitor high-risk identities.

And in organizations, adopt the central Zero Trust idea that access should be granted according to verified identity, device, context and need rather than assumed because someone is already “inside.”

Identity security is ultimately about controlling trust.

The strongest authentication proves who is requesting access.

Strong authorization limits what that identity can do.

Session security keeps checking whether access should continue.

Least privilege limits the consequences when something goes wrong.

Together, those controls make stolen identities much less valuable to attackers.

For the complete framework covering malware, phishing, ransomware, privacy, account protection, network security and cyber resilience, continue with The News Ink’s Cybersecurity Explained: Complete Guide.

Follow The News Ink

Stay connected with The News Ink for cybersecurity, artificial intelligence, technology, business and major global developments.

Follow The News Ink on X, Instagram and Threads.

Join The News Ink WhatsApp Channel for updates, and follow The News Ink on Medium for longer explainers and analysis.