Identity & Authentication Market Intelligence — Weekly Brief

Week of 22 June 2026 | Compiled by Team Paringa

A weekly digest of significant developments in enterprise identity security, phishing-resistant authentication, and MFA compliance. For IT security leaders, CISOs, and compliance teams navigating the evolving identity threat landscape.

SECTION 1 — What Happened This Week

🔴 Salesforce Enforces Phishing-Resistant MFA — Starts Today

Salesforce begins enforcing phishing-resistant MFA for privileged users in sandbox environments today, 22 June 2026. Production enforcement follows on 1 July 2026.

Affected roles: System Administrators, and users holding Modify All Data, View All Data, Customize Application, or Author Apex permissions. If these users are not authenticating with a phishing-resistant method, they will be blocked from access.

The critical detail: standard MFA does not satisfy this requirement. SMS codes, authenticator apps, and push notifications — all commonly used and considered "secure" — do not qualify as phishing-resistant under Salesforce's definition. Only FIDO/WebAuthn-compliant methods (hardware security keys, passkeys, or platform authenticators like Windows Hello and Touch ID) meet the bar.

For any organisation running Salesforce with affected users, this is not a future consideration — the enforcement window is now open.

Sources: AllCloud — Salesforce Phishing-Resistant MFA | GoNimbly — What Admins Need to Know | Vantagepoint — Salesforce Security Overhaul 2026

🔴 NIS2 and DORA — Phishing-Resistant MFA is Now a Legal Requirement in Europe

NIS2 Article 21(2)(j) mandates "secured authentication" for essential and important entities across the EU. ENISA guidance names FIDO2 and PKI as the reference implementations. For financial entities, DORA Article 9 applies the same requirement under EBA ICT Risk Management Guidelines.

This covers a broad range of organisations: any enterprise in energy, transport, healthcare, banking, financial market infrastructure, digital infrastructure, or public administration with operations in an EU member state. If you operate in these sectors and are running SMS or push-notification MFA, you are non-compliant with NIS2.

NYDFS, PCI DSS 4.0, and HIPAA security rule updates in 2026 have moved in the same direction for US-regulated entities. Enforcement actions are no longer theoretical — fines for non-compliance with these frameworks now regularly exceed $5–10 million.

Sources: Hideez — Phishing Resistant MFA 2026 Enterprise Playbook | Sesame Disk — Phishing-Resistant MFA 2026 Regulations and Trends | CISA — Implementing Phishing-Resistant MFA

🔴 Identity-Based Attacks Are Now the Primary Enterprise Breach Vector

Multiple 2026 security industry reports confirm a structural shift in how enterprise breaches begin. Credential theft, session hijacking, and MFA bypass have overtaken traditional phishing-with-malware as the dominant initial access method.

The techniques in active use: SIM swapping (defeating SMS MFA); real-time phishing proxy kits (intercepting OTP codes the moment they're entered); MFA push fatigue (spamming approve/deny requests until a user clicks accept); and post-authentication session token theft (bypassing MFA entirely by stealing the authenticated session rather than the credential).

The implication is straightforward: an organisation that has deployed standard MFA and considers the identity risk "managed" may have a false sense of security. The attacks have adapted to the controls.

Sources: SentinelOne — What Is Phishing-Resistant MFA | MiniOrange — MFA Best Practices 2026 | Infisign — Phishing-Resistant MFA: How to Protect Your Organisation in 2026

Paringa insight: There is a distinction that matters here and isn't always made clearly: passwordless is not the same as phishing-resistant. Many "passwordless" solutions — including some well-marketed ones — are still susceptible to proxy interception attacks because the authentication token can be captured and replayed in real time. Genuinely phishing-resistant authentication requires a cryptographic binding between the authentication method, the device, and the domain — so that intercepted credentials simply don't work on a different connection. If you're evaluating identity solutions and this distinction hasn't come up, it's worth asking directly.

SECTION 2 — What's Coming Next in Identity Security

The AI Threat to Authentication

Attackers are now deploying AI at the social engineering layer of identity attacks. AI-generated voice and video deepfakes are being used to impersonate executives and IT support staff to social-engineer help desks into resetting MFA. These calls are convincing enough that standard voice verification procedures are failing.

Separately, AI is automating the credential stuffing and phishing proxy pipeline — attacks that previously required manual operation can now run at scale with minimal human involvement.

The security industry's response is moving in two directions: improving the technical controls (shifting to cryptographically-bound authentication that AI-proxy attacks can't intercept) and improving the human controls (training, verification procedures, and identity verification that doesn't rely on recognising a voice or face).

Sources: SecureWorld — Identity Management Day 2026: Securing the New Perimeter | MiniOrange — MFA Best Practices 2026

Three Things Worth Watching Next Week

1. Salesforce production enforcement (1 July) — monitor for any reported disruptions as organisations scramble to comply. The rush to implement phishing-resistant MFA in the next 9 days will expose gaps in identity infrastructure that have been overlooked.

2. NIS2 enforcement actions — the EU's NIS2 enforcement machinery is accelerating. Watch for any public fines or regulatory actions related to authentication standards — these tend to trigger sector-wide reassessment.

3. Biometric MFA controversy — several European DPAs are actively scrutinising the use of biometric data (fingerprint, FaceID) for enterprise MFA under GDPR Article 9. If your MFA rollout relies on biometrics, this regulatory thread is worth monitoring.

Questions about this week's brief or want to understand how phishing-resistant authentication applies to your compliance requirements?

hello@paringa.ai

Paringa works with enterprise organisations on security, AI governance, and identity. We work with specialist partners to deploy phishing-resistant, GDPR-compliant identity solutions that satisfy NIS2, DORA, and sector-specific requirements. If something in this brief connects to a challenge you're navigating, we're happy to talk.