Managed Unfishable Authentication
Route every work login through centrally enforced phishing-resistant controls
- Difficulty
- Advanced
- Time to result
- ~months to results
- Steps
- 5
- Confidence
- 98%
This method treats phishing as an authentication-design problem rather than relying primarily on employees to recognize every deceptive message. The organization establishes a source of truth for employee identities, issues phishing-resistant authenticators, and requires every work application to use those methods. Logins are routed through managed browsers so security teams can enforce the policy consistently and observe endpoint context. When coverage is complete, a worker may still click a malicious link, but the attacker cannot successfully reuse the interaction to authenticate. The mechanism therefore changes the expected outcome of human error. Training can remain useful, but protection no longer depends on near-perfect judgment across thousands of emails, websites, employees, and repeated attack attempts.
Origin
David Adrian described this deployment pattern while discussing phishing protection for game companies on Security Bookmarked.
Core principles
- 01Assume employees will eventually encounter and click convincing phishing links
- 02Authentication should fail safely even when users are deceived
- 03Every application must participate for the control to be dependable
- 04A managed browser can provide a centralized enforcement point
- 05Security should protect users by default rather than demand constant suspicion
How to run it
- 1
Create an identity source of truth
Maintain an authoritative directory of employees, roles, devices, and employment status.
Pro tip Automate prompt deprovisioning when a worker leaves or changes roles.
Watch out Conflicting identity records create gaps in enforcement.
- 2
Issue resistant authenticators
Provide employees with authentication methods designed not to disclose reusable credentials to phishing sites.
Pro tip Pilot with security staff and high-value account holders before broad rollout.
Watch out Ordinary passwords plus weak second factors may remain phishable.
- 3
Inventory work applications
Identify every application employees use and document its authentication path.
Pro tip Include smaller SaaS tools used by specialist or remote teams.
Watch out One uncovered application can preserve a viable phishing route.
- 4
Centralize login enforcement
Require approved authentication methods and route work logins through managed browsers or equivalent controlled access points.
Pro tip Block unmanaged exceptions rather than merely reporting them.
Watch out Optional enforcement produces inconsistent protection.
- 5
Verify complete coverage
Test attempted logins from phishing-like domains, unmanaged browsers, and unauthorized devices, then monitor exceptions continuously.
Pro tip Track application coverage and blocked authentication attempts as operational metrics.
Watch out Do not declare phishing solved until every relevant login path is tested.
In the wild
A game company inventories its code repository, build platform, asset store, email, and collaboration tools. It issues phishing-resistant tokens and permits employee authentication only through managed browsers using the approved method.
→ A developer who enters a password into a deceptive site does not provide the attacker with a usable path into protected applications.
Common mistakes
Relying on perfect employee detection
Even extremely effective awareness programs leave enough residual error for repeated phishing campaigns to succeed.
Leaving application exceptions
Attackers will target work applications that still permit weaker authentication or unmanaged login paths.
Ignoring user experience
Poor deployment encourages workarounds, while well-designed strong authentication can be easier for employees to use.
Is it for you?
Best for
Enterprises whose employees access most work applications through web browsers.
Not ideal for
Environments dominated by legacy applications that cannot support modern authentication or managed access paths.
From the transcript
“the number one thing that I would be doing is deploying strong, unfishable authentication.”
“And so if you can deploy those authentication methods and you can make all logins only go through a web browser and only use those…”
“with the right authentication, they'll actually be protected by default”
From the episode
Security, Bookmarked: Gaming (Sponsored Content)