The prevailing approach to securing data and resources has been the same since the inception of the internet. For as long as developers have been writing software, we have been reliant on passwords, passphrases and pins.

In a cyclical cat and mouse game with the bad actors, the solution has always been to introduce more complexity; longer passwords, special character requirements, the addition of PIN’s, SMS and now passwordless authentication.

None of these deter attackers, and they actually introduce more risk in the form of poor practices, like incentivizing password re-use and using solutions like centralized passwords managers.

From 2021 to 2023, M365 Applications represented 61% of compromises worldwide – statista.com

73% of US small business reported a cyber attack in 2023 – idtheftcenter.org

81% of confirmed breaches in 2022 were due to weak, reused, or stolen passwords – lastpass.com

Attackers have a myriad of known ways to compromise accounts via brute-force, dictionary attack, targeted phishing, etc.

SMS has a huge vulnerability known as the SS7 attack as well as SIM swaps, it’s useless as MFA

Big name authenticator apps are vulnerable to spam attacks, including the Mamba MFA bypass attack

All forms of authentication are vulnerable to attack including internet base layer protocols like SMTP for email delivery

The only cost to a bad actor to attack or breach an account is time, which is something they have

Without a deterrent they are enabled to attack at scale in an automated fashion with ease