CISA dropped a bombshell

CISA's Urgent Warning on Phishing-Resistant MFA and FIDO2

CISA just dropped a bombshell. In its latest alert (dated July 25, 2025), the U.S. Cybersecurity and Infrastructure Security Agency is now urging every enterprise to implement phishing-resistant multifactor authentication (MFA)—everywhere: for email, VPNs, and anything touching critical systems. Not “consider it.” Not “evaluate in the future.” Require it. Now.

Kevin Surace
1 minute read
Social Engineering Hacks Keep Winning

How to Prevent Social Engineering Attacks

Another day. Another preventable breach. This time it’s a major UK based insurance company, Allianz Life, and the attackers didn’t need zero-day exploits or complex malware. They just talked their way in.

Kevin Surace
1 minute read

The Clorox Lawsuit: 380M Over a Password

Kevin Surace
1 minute read
Identity-Based Attacks

The Rise of Identity-Based Attacks

BetaNews recently asked this question in a detailed Q&A. The answers should concern every enterprise leader. The rise of identity-based attacks isn’t just a trend; it’s now the primary way cybercriminals get in. Attackers are no longer brute-forcing firewalls or cracking encryption. They’re simply logging in as you.

Kevin Surace
1 minute read

Phishing-Proof MFA That Stops Social Engineering

Microsoft’s recent advisory on Octo Tempest should make every CISO lose sleep. This group isn’t just hacking software vulnerabilities. They’re hacking people, impersonating employees, tricking help desks into resetting passwords, stealing session cookies, and bypassing legacy MFA with social engineering.

Kevin Surace
1 minute read

AI-Generated Phishing Attacks Are Making Legacy MFA Obsolete

Generative AI just made phishing so easy that anyone can do it—and do it convincingly. According to Axios, researchers demonstrated that in just 30 seconds, a simple natural-language prompt was all it took to build a pixel-perfect spoofed login site. No coding. No technical skills. Just type “build a copy of the website login.okta.com,” and a convincing clone appears, ready to trick anyone into handing over credentials.

Kevin Surace
2 minute read
Stolen credentials are the new front door

Stolen Credentials Are the New Front Door

The cybersecurity world has a new consensus: credentials are no longer a weak point—they’re the entire attack surface.

Kevin Surace
2 minute read
Scattered Spider is targeting Fortune 500 firms

Scattered Spider Hackers Are Hunting the Fortune 500

A new report from CyberCube just confirmed what many of us in cybersecurity have long suspected: Scattered Spider is targeting hundreds of major enterprises with precision. Nearly 300 companies—each with over $500 million in annual revenue—have been flagged as high-risk. Why? Because they’re still running the same legacy technologies this threat group exploits with shocking ease.

Kevin Surace
1 minute read
Scattered Spider 500+ domains

Scattered Spider's 500+ Phishing Domains and How to Stop Them

If your organization still relies on passwords, SMS codes, or authenticator apps to protect employee logins, it’s not a matter of if you’ll be breached—it’s when.

Kevin Surace
3 minute read
The MFA your trust is lying to you

The MFA You Trust Is Lying to You

As seen in Bleeping Computer

Kevin Surace
< 1 minute read
What are passkeys? Passkeys vs Token

What Is a Passkey - And Why You Need to Go Further

The shift to a passwordless future is well underway. Tech giants like Apple, Google, and Microsoft have embraced passkeys, and for good reason. Passwords have long been the weakest link in cybersecurity—easily guessed, phished, stolen, or reused across accounts. Passkeys represent a serious improvement. They’re phishing-resistant, user-friendly, and eliminate the need to remember or manage credentials.

Kevin Surace
4 minute read
Ingram Micro Down. Ransomed.

The Ingram Micro Ransomware Attack and the Legacy MFA Failure

Token Would Have Stopped This Cold. Another week, another breach. This time it’s Ingram Micro, one of the largest tech distributors on the planet. Systems down for days. Operations halted. Now they’re staring down a ransomware demand, possibly for millions.

Kevin Surace
2 minute read

Stay Identity Assured

Subscribe to The Assured Identity Brief for sharp insights on identity security, authentication, and the threats security leaders must stay ahead of.