Cyber Security Threats — What Actually Matters in 2026
A clear-eyed overview of the threats that drive identity and hardware-credential decisions today — written so a security lead can take it into a budget conversation.
The list of cyber threats is endless. The list of threats that should drive your identity and hardware-credential decisions is short. This post is the short list, with what to do about each.
Phishing (still)
Credential phishing remains the cheapest, most reliable entry point. The modern variant is no longer "fake login page emailed in PDF". It is:
- Adversary-in-the-middle (AitM) proxies — tools like Evilginx that pass the user’s session to the real site while harvesting cookies. Defeats SMS, TOTP, and push MFA.
- Reverse-proxy phishing kits that capture not just credentials but the second factor as it’s used.
- Consent-grant phishing on cloud platforms (OAuth consent attacks), bypassing credential checks entirely.
What works: origin-bound credentials. FIDO2 / WebAuthn refuse to authenticate to a phishing origin even if the user can see no difference. SMS and TOTP cannot tell the difference; FIDO2 can. This is the core argument for hardware-backed identity.
MFA fatigue and bypass
"Push fatigue" attacks against MFA push notifications. The attacker has the credential; they push approval requests until the user taps "approve" by mistake or out of irritation. Documented in some of the largest breaches of the last 24 months.
What works: remove pushes from the second-factor catalogue. Replace with hardware-bound FIDO. Push has its place in low-assurance flows; it should not be the bar for production access.
SIM swap
Active and effective against any account whose recovery flow trusts SMS. A successful SIM swap gives the attacker any account where SMS is a fallback — even if the user’s primary MFA is stronger.
What works: remove SMS as a recovery path. Replace with in-person re-issuance or sealed backup hardware credentials.
Credential stuffing
Automated reuse of breach-corpus credentials against your login. Cheap, reliable, scales to millions of attempts per day. The only thing that consistently kills credential stuffing is removing the password from the login path entirely.
What works: passwordless authentication as primary. (See Designing Enterprise Passwordless Systems.) Anything else is rate-limiting and bot-detection, which buys time, not safety.
Device cloning and key extraction
For hardware-credential programmes, the analogue of credential phishing is device cloning — an attacker with physical access to a device extracts keys and impersonates it. This is the threat that drives the requirement for secure-element / TPM / HSM hardware rather than software-stored keys.
What works: hardware-rooted identity with attestation. (See Why Hardware-Backed Identity Matters and Secure Element vs TPM vs HSM.)
Supply-chain compromise
Compromise upstream of the customer — in a vendor, a library, a build pipeline. Hard to defend against at the consuming end; the response is to limit blast radius (least-privilege, segmentation, attestation of components) rather than prevent.
Relevant to hardware-identity programmes: source your secure elements from chip vendors you have a direct supply chain with, and verify attestation against the manufacturer’s root rather than trusting blanket "FIPS certified" labels.
Threats that get discussed but don’t drive decisions yet
- Quantum-computing-driven cryptographic break. Real, but not in time-window for most credential lifetimes. Plan for cryptographic agility (algorithm rotation in your hardware) but don’t panic-migrate.
- Side-channel attacks on consumer hardware. Newsworthy; in practice, the secure-element vendors’ CC EAL5+ side-channel hardening covers the realistic attack surface.
- "Deepfake bypass" of biometric auth. Worth attention; matters at scale only for low-assurance flows. Hardware-backed biometric (on-card fingerprint, secure-enclave face) is much harder to bypass than image-or-video-only.
What to do, in order
- Replace SMS-and-TOTP MFA on privileged accounts with hardware-backed FIDO.
- Remove SMS from your recovery flow.
- Plan an attestation policy — AAGUID allow-list + FIDO MDS verification.
- Move toward passwordless primary auth for the workforce. (Realistic timeline: 18-24 months.)
- For hardware-product lines, put a secure element on the BOM and design the personalisation flow around attestation.