Phishing-Resistant Authentication at Enterprise Scale

The problem

Most enterprises still rely on phishing-vulnerable credentials, creating dangerous security gaps across their workforce. Regulatory mandates such as NIST 800-63 and PCI 4.0 no longer consider SMS, OTP, and push-based MFA adequate security.

True phishing-resistant MFA requires hardware-backed authentication: either Certificate-Based Authentication (CBA) or FIDO2. Both bind identity to a physical device using public key cryptography so credentials cannot be intercepted, replicated, or used outside the hardware token. The challenge is deploying and managing these technologies at enterprise scale — across thousands of users, multiple platforms, and existing CA and IAM infrastructure.

The solution

Thales provides high-assurance hardware authenticators for CBA and FIDO2. Axiad Conductor automates credential lifecycle management across any CA, any IAM system, and any endpoint platform. Together, they deliver phishing-resistant MFA at enterprise scale without ripping and replacing existing infrastructure.

MFA that is Defensible, Manageable, and Usable:

1. Defensible — Hardware-bound CBA and FIDO2 credentials on Thales authenticators eliminate phishing risk at the identity layer
2. Manageable — Automated end-to-end lifecycle management: issuance, renewal, revocation, and recovery from a single platform
3. Usable — Self-service enrollment and credential recovery on any platform reduces IT burden and keeps users productive

‍Key capabilities

• CA-agnostic and IAM-agnostic
  Axiad Conductor connects to an organization’s existing Certificate Authorities such as Microsoft CA, Entrust, DigiCert, and others. Alternately, organizations can use the built-in Axiad CA with advanced features including multi-domain support, fine-grained access policies, and customized certificate profiles. Conductor supports all major IAM platforms including Microsoft Entra ID, Okta, and Ping Identity. No infrastructure replacement is required.

• CBA and FIDO2 from one platform
  CBA delivers hardware-enforced user identity for application access, VPN, and desktop login across Windows, macOS, and Linux. FIDO2 complements CBA for cloud-native and web-based access. Management is streamlined because both credential types are managed through a single administrative interface.

• Multi-platform coverage
  Axiad Conductor manages CBA and FIDO2 lifecycle management for Thales authenticators across Windows, macOS, Linux, and mobile endpoints. Unlike other approaches, Certificate-Based Authentication is not a Windows-only capability.

• Self-service and zero-touch workflows
  Users enroll, recover, and renew credentials through the Axiad User Portal from any location without contacting IT. Zero-touch provisioning minimizes IT overhead and accelerates deployment while reducing help desk calls by 50%. Emergency access is handled through secure, self-service identity verification such as with Axiad Confirm.

• Secure SaaS architecture
  Axiad Conductor is a SaaS solution with no software to install or maintain (although hybrid, air-gapped, and on-premises deployments are possible). Each customer operates in a dedicated virtual private cloud with encryption keys stored in a FIPS-certified HSM. It is FedRAMP Moderate authorized for federal customers and contractors.

• 10x faster deployment
  Automated provisioning and lifecycle management accelerates phishing-resistant MFA rollouts up to 10 times faster than manual approaches.

Key use cases

1. Government
   U.S. federal agencies must deploy derived credentials across distributed, mixed-OS workforces without replacing existing CA infrastructure. Axiad Conductor, FedRAMP ATO (Moderate), automates derived credential issuance and lifecycle management on Thales hardware tokens across any CA to meet OMB and DISA requirements without a forklift infrastructure change.‍
2. Financial services
   CI 4.0 and internal risk mandates are pushing financial institutions to eliminate exportable software credentials across workforces spanning branch, remote, and privileged back-office users. Axiad Conductor and Thales hardware authenticators deliver CBA and FIDO2 across Windows, macOS, and Linux from a single platform, without requiring a CA replacement.
3. Healthcare
   Clinicians authenticate repeatedly across shared workstations throughout their shift and slow logins directly impact patient care. Thales hardware authenticators enable fast, tap-and-go CBA across shared endpoints, while Axiad Conductor manages the credential lifecycle across clinical and administrative staff from a single platform.‍
4. Critical infrastructure & manufacturing
   Operators authenticate to OT systems and remote access infrastructure from ruggedized or non-standard endpoints, often in low-connectivity environments with legacy PKI that cannot be easily replaced. Thales hardware tokens deliver strong CBA for operator identity, while Axiad Conductor's CA-agnostic architecture adds automated lifecycle management on top of existing PKI with no infrastructure replacement required.

‍