Phishing-resistant authentication
Hardware-backed and origin-bound credentials remove the class of failure where a convincing page collects a code. This is the clearest example of design beating vigilance.
Research pillar · Zero Security Theatre
Human error without human blame
A large part of security practice asks employees to remember instructions and behave correctly under time pressure. This pillar studies what happens when that expectation is replaced with technical arrangements that make the safe action the default.
The question
Which controls can be designed so that remembering is not required?
Active · since 2026 · Zero Security Theatre
The working principle
recommendation
If a control depends on somebody remembering a training slide from six months ago, assume it eventually fails, and design accordingly. Training remains useful where human judgment is genuinely unavoidable. It should not be the primary control where technology can prevent or detect the failure.
The problem is in the design. Blaming the person who clicked fixes nothing because someone else will click next time.
Substitutes for memory
recommendation
Each moves a remembered task into the system. They will not help equally, so the effect of each still needs to be measured.
Just-in-time and least privilege
Access that exists only while it is needed shrinks the blast radius of any single compromise without asking anyone to remember to log out of an admin role.
Automatic credential and secret detection
Scanning and revocation paths that assume secrets will be committed, pasted, and logged, because they will be.
Fail-closed defaults
Systems that stop rather than continue when a check cannot be completed, with an explicit approval path for the exception.
Risk-based authentication and session revocation
Re-verification and automatic session termination triggered by observed conditions rather than by a user decision.
Allowlisting and sandboxing
Constraining what can execute and where attachments open, so a mistaken action has a bounded consequence.
Behaviour is measurable, attendance is not
inference
Training completion rates are an attendance record. The measurable alternatives are behavioural: reporting rate for suspicious messages, time from receipt to report, credential submission rate under simulation, and the share of staff for whom a successful phish would produce no usable credential at all.
The last of those is the most interesting, because it is a property of the authentication design rather than of the people.
What would prove us wrong?
unknown
The pillar claims that training alone provides limited resilience without technical controls.
- Evidence that a specific training approach materially and durably reduces successful attacks in organisations with comparable technical controls.
- Results where removing memory-dependent controls produced complacency that raised exposure elsewhere.
- Data showing that phishing-resistant authentication shifts attackers to paths that are more damaging rather than less, leaving total loss unchanged.
Put this to work
Research decision record
Use the question “Which controls can be designed so that remembering is not required?” on a real case and produce a record another person can challenge.
- For
- Practitioners, researchers, founders, and operating leaders.
- What you keep
- A research decision record you can review, revise, and send.
- What counts as sound
- Answers a named decision
- Separates evidence from assumptions
- Includes the strongest contrary case
- Names missing evidence
- Ends with a test, owner, and date
The result is a working analysis. Check it against source evidence and qualified judgment.
Nothing entered here is stored or sent. Review the prompt before sharing confidential, personal, patient, or privileged information.
Review the prompt
You can leave any field blank. The prompt will mark it as not provided.
If the record survives your review, send the question, evidence, unknowns, and requested next step.
Experiments for this pillar
- Bounded credential rotation
Could the organisation rotate every secret of one class quickly if it had to?
Patterns and anti-patterns
Pattern
Replace remembered behaviour with system behaviour
For each thing staff are asked to remember, look for an arrangement that makes the unsafe action impossible, expensive, or automatically reversible. Keep training for the judgment that genuinely cannot be designed out.
Anti-pattern
Treating training completion as a control
Completion is an attendance record. Where a technical control could prevent or detect the failure, training is a supplement to it, not a substitute for it.
Evidence for this pillar
- NIST SP 800-63, digital identity guidelines
Authenticator assurance levels, including the properties that make a credential resistant to phishing.
- CISA guidance on phishing-resistant multifactor authentication
Shows how the credential itself can block phishing even when a message fools the user.
- CISA Secure by Design
Places responsibility for safe defaults with the supplier, which is the vendor-side form of this area's design argument.
Notes under this pillar
Design Patterns
- Design out the memory dependency
For each control that depends on a person recalling guidance under pressure, look for a technical arrangement that makes the safe action the default or the only one.
2026-09-15
Operating Theorys
- Phishing resistance belongs in the credential
Origin-bound, hardware-backed authentication removes a whole class of failure regardless of how convincing the message was. This is the clearest available example of design beating vigilance.
2026-09-15