Identity & Authentication Market Intelligence — Weekly Brief

Week of 6 July 2026 | Compiled by Team Paringa

A weekly digest of significant developments across enterprise identity security — passwordless authentication, phishing-resistant MFA, regulatory compliance, and what the credential threat landscape looks like right now.

SECTION 1 — What Happened This Week

🔴 24 Billion Stolen Credentials Exposed in Global Infostealer Database

A global infostealer database containing over 24 billion stolen credentials was identified and published this week by threat intelligence researchers. The database aggregates credential sets harvested by infostealer malware families — Redline, Vidar, Raccoon, and their successors — operating across enterprise and consumer environments over the past 18 months.

The significance is not just scale. Infostealer-harvested credentials are qualitatively different from breached password databases: they capture credentials as they are typed, including session tokens, cookies, and MFA codes that bypass traditional password-based defences. An organisation that has rolled out standard MFA but not phishing-resistant authentication remains vulnerable to the class of attack that produced this database.

What to consider: Any credentials used in enterprise environments — including email, SaaS platforms, VPNs, and developer toolchains — should be considered potentially compromised if employees use the same credentials across personal and work contexts. Credential hygiene review and phishing-resistant authentication rollout are the structural responses.

Sources: BigID — PII Data Protection in 2026 | Bluefin — From Breaches to Business Risk: A 2026 Data Privacy Reality Check

The 24 billion credential database is a reminder that standard MFA — SMS codes, push notifications, TOTP apps — does not protect against the dominant credential theft mechanism in 2026. Infostealers harvest session tokens and MFA codes in real time, bypassing authentication entirely. Phishing-resistant MFA, where the cryptographic key never leaves the device, is the only authentication mechanism that neutralises this attack class at the point of entry. FIDO2 passkeys and hardware security keys exist precisely for this threat.

🔴 NIS2 Audit Enforcement Live — First Penalties Now Applied

NIS2 compliance audit enforcement is now live across EU member states following the 30 June implementation deadline. The first penalties have been applied in the Netherlands and Germany, with regulatory bodies confirming that authentication controls are among the primary audit criteria. Organisations relying on legacy SMS-based or app-push MFA are being flagged as non-compliant under NIS2's requirement for "state of the art" authentication practices.

NIS2 explicitly requires multi-factor authentication that is resistant to phishing — a standard that SMS OTP and standard push notifications do not meet under the current regulatory interpretation. The DORA framework, applicable to financial services entities, applies the same standard and includes specific provisions on credential management for third-party access.

For UK organisations, while no longer subject to NIS2 directly, the ICO's guidance under the Network and Information Systems (NIS) Regulations UK has moved in lockstep, and the UK Data Use and Access Act (in force since 23 June 2026) strengthens the accountability framework around authentication security.

Sources: PII Tools — Top 3 Data Regulation Changes in 2026

The NIS2 enforcement signal is now concrete: regulators are not treating legacy MFA as a compliant control. Organisations that have deployed SMS or push-based MFA and filed compliance reports on that basis are exposed. The remediation path — replacing legacy MFA with phishing-resistant FIDO2 or passkey-based authentication — is not a long project. For most enterprise environments, targeted rollout across high-risk access points takes weeks, not months.

🟡 Microsoft Makes Phishing-Resistant MFA Default Across All Entra Managed Tenants

Microsoft has made phishing-resistant MFA the default authentication requirement for all Entra managed tenants — a change that affects every organisation running Microsoft 365, Azure, or any Entra-connected SaaS application. Legacy methods including basic authentication, SMS OTP, and standard push notification MFA are being progressively deprecated and blocked.

The change is significant, but the headline overstates the protection. "Phishing-resistant" in Microsoft's framing means FIDO2 keys, Windows Hello for Business, or certificate-based authentication — all of which still depend on device trust, token issuance, and post-authentication session integrity. Adversary-in-the-middle (AiTM) attacks — which intercept the authenticated session token rather than the credential itself — continue to bypass these controls effectively, and are already widely documented against Entra-protected environments. The method of authentication has improved; the attack surface has not disappeared.

The operational picture is also more complicated than the announcement suggests. Remediation is not a one-click toggle. Some tenants will find conditional access policies already meet the baseline; others will find service accounts, break-glass accounts, and legacy integrations that cannot comply without planned rollout. Microsoft has published migration guidance, but in practice the exceptions are where the exposure lives.

What to consider: Audit your current Entra MFA configuration against Microsoft's new default baseline — but do not stop there. The more fundamental question is whether any solution that still issues a credential or a session token at the point of authentication can be considered truly phishing-resistant. Stolen credentials and hijacked sessions are not the same attack — but both result in the same outcome. Organisations that want to eliminate credential theft as a risk category entirely should evaluate authentication models that issue no credential at all: symbol-based or zero-knowledge approaches where there is nothing for an attacker to intercept, replay, or steal — and which typically come in at a significantly lower cost than enterprise FIDO2 deployments at scale.

Sources: BigID — PII Data Protection and Identity Security 2026

SECTION 2 — What Identity Teams Are Dealing With

The Passkey Inflection Point: Enterprise Adoption Crosses 40%

FIDO Alliance data published this week confirms enterprise passkey adoption has crossed 40% among organisations with more than 1,000 employees — a doubling from 2025. Apple, Google, and Microsoft have all made passkeys the default credential creation path for new accounts on their platforms, and enterprise IAM vendors including Okta, Microsoft Entra, and CyberArk have shipped phishing-resistant passkey support across their stacks.

The holdout cases are predictable: legacy applications that cannot be updated to support WebAuthn, operational technology environments with shared workstations, and organisations mid-way through IAM platform migrations. For these scenarios, hardware security keys remain the compliant bridge solution.

The broader trend is clear: the industry has crossed the passkey inflection point. Passwords as the primary enterprise authentication mechanism are on an explicit replacement trajectory — the question is no longer if, but how fast each organisation's legacy tail can be managed.

Three Things Worth Watching Next Week

1. NIS2 penalty disclosures — The Netherlands and Germany are expected to publish formal penalty notices for the first NIS2 violations. The specific controls cited will inform which gaps other organisations need to close most urgently.

2. Microsoft Entra conditional access changes — Microsoft's phishing-resistant MFA default rollout continues. Watch for tenant notifications confirming the specific block dates for legacy authentication methods in your region.

3. Infostealer follow-on intelligence — The 24-billion-credential database is expected to be cross-referenced against major breach notification services this week. Any organisations receiving alerts should treat them as confirmed exposure events.

Questions about anything in this brief, or want to talk through how it applies to your environment?

hello@paringa.ai

Paringa works with enterprise organisations on identity security, AI governance, and infrastructure. We partner with specialist authentication providers to deliver phishing-resistant authentication across enterprise environments. If something here connects to a challenge you're working through, we're happy to have a conversation.