What Is Authentication?

Authentication establishes who someone is. It is routinely confused with authorisation, which establishes what they may do, and the distinction matters because they fail differently and are attacked differently.

Proving identity rests on factors: something you know, something you have, and something you are. The security of the whole arrangement depends far more on which factors are used and how they are implemented than on how many are counted.

Passwords alone stopped being sufficient

Not because people choose badly, though they do, but because credentials are stolen in bulk and reused. Attackers do not usually guess a password; they obtain one from an unrelated breach and try it, or they phish it, or they capture it from a device.

That shifts the defensive question away from complexity rules toward whether a stolen password is sufficient on its own. Where it is, the control is one breach away from failing regardless of how many characters it required.

Phishing resistance is the property that matters now

A second factor helps, and not all second factors are equal. Codes sent by message or generated by an application can be relayed by an attacker in real time — the user enters the code on a convincing fake site and the attacker immediately uses it.

Factors bound to the origin, such as hardware security keys and passkeys, cannot be relayed this way: the cryptographic response is specific to the site requesting it, so a fake site receives something useless. That distinction is now the meaningful one, more than the number of factors.

Where authentication is weakest in most estates

Not in the primary sign-in flow, which usually receives attention, but in the paths around it. Password reset and account recovery are frequently weaker than the authentication they can bypass — knowledge questions with discoverable answers, or a code to an email address that may itself be compromised.

Help desk procedures are the other route, and increasingly the preferred one. An attacker who can persuade support to reset credentials or enrol a new device has defeated every factor without touching any of them. Verification that does not rely on knowledge questions is the control, and it needs to apply regardless of how senior or insistent the caller sounds.

Passwordless is arriving, unevenly

Passkeys replace the password with a key pair bound to a device and unlocked locally by biometric or PIN. There is no shared secret to phish, no credential to reuse across sites, and nothing for a breach elsewhere to expose.

The obstacles are practical rather than conceptual: account recovery when a device is lost, synchronisation across devices, and applications that cannot yet support it. Most organisations will run passwordless and password-based authentication concurrently for years, which means the weaker path remains available and remains the one attackers use.

Where to start

Establish which of your systems accept a password alone, and which second factors are phishing-resistant. Those two lists describe your actual authentication posture more accurately than any policy document.

See MFA in practice and why MFA alone is not enough. GuardsArm delivers zero trust security.