Passkeys offer greater security as AI lowers phishing barrier

Artificial intelligence is making phishing attacks more convincing and difficult to identify, prompting organisations to reconsider their reliance on employee vigilance and adopt stronger authentication methods.

Growing sophistication of AI-generated messages and accessibility of phishing tools are increasing the risks facing businesses, with traditional cybersecurity training no longer sufficient to protect employees from more convincing attacks, said Geoff Schomburgk, Vice President APJ at Yubico.

Schomburgk cited recent Yubico research that indicated 37 per cent of respondents could not distinguish between a human-written message and one generated by AI.

The findings highlight the challenges facing security teams as attackers use AI to improve the quality of phishing campaigns.

"The reliance on the vigilance of the individual and the typical cybersecurity training, spot the phishing link sort of thing, we're moving away from that," Schomburgk said.

"Taking away the reliance on the vigilance of the user, because AI is making that irrelevant.

"We can't spot the difference."

Schomburgk argued that organisations need to shift towards security technologies capable of preventing attacks rather than expecting individuals to identify every threat.

For Yubico, which specialises in authentication technology including physical security keys, that means encouraging greater adoption of passkeys and phishing-resistant MFA.

AI lowering barrier to phishing attacks

AI has substantially reduced the barrier to launching phishing attacks, making sophisticated techniques more accessible to potential attackers who don't need advanced skills.

"It's virtually non-existent now," Schomburgk said.

At the same time, AI is improving the quality of fraudulent communications, making it increasingly difficult for employees to determine whether a message is legitimate.

This development is having implications beyond English-speaking markets, with technology helping attackers produce more convincing messages in languages that might previously have presented a greater challenge.

Japan and Indonesia are examples of markets where the ability to generate more natural-language phishing messages are increasing the effectiveness of attacks.

The combination of lower costs, easier access to attacking tools and more sophisticated messages is putting significant pressure on security teams to adopt defences that do not depend on employees consistently recognising malicious activity.

The industry needs to move beyond the assumption that awareness training alone will adequately protect organisations.

Passkeys offer alternative to passwords

Yubico is advocating broader adoption of passkeys, which use cryptographic authentication rather than relying on users entering traditional passwords.

Schomburgk said the technology was already supported by major industry players, meaning the primary challenge was no longer whether it worked, but whether organisations and individuals were prepared to adopt it.

Australian users are particularly reluctant to abandon familiar authentication methods after decades of using passwords.

For many people, replacing a password with a passkey can appear unfamiliar, even when the alternative offers stronger protection.

However, MyGov, Telstra and Qantas have now adopted passkeys, bringing them more into the mainstream.

There is still a gap between awareness of the technology and its widespread adoption, including among people who understand its security benefits.

"People understand the tech is there. Passkeys are a good thing. They are phishing-resistant," Schomburgk said.

"It's just that action gap that we've got to try and close."

To make the transition less intimidating, businesses should educate users, demonstrate how the technology works and provide practical examples.

Research finds Australians want greater control over AI

Beyond phishing, the growing use of agentic AI within companies is raising questions about identity, accountability and the level of authority businesses should give autonomous systems.

"A healthy level of scepticism at this nascent stage of agentic adoption is a good thing," Schomburgk said.

The risks associated with allowing AI systems to act without sufficient checks and balances reinforces the need for safeguards.

Schomburgk posited that Australia's relatively conservative attitude towards AI and automation could stem from previous experiences with large technology projects that did not deliver their intended outcomes.

The challenge facing businesses in a rapidly changing landscape is balancing the productivity opportunities offered by AI with the need to understand its potential consequences.

Schomburgk said conversations with CISOs and other executives are increasingly centred around AI, including how organisations can use it productively while preventing malicious actors from exploiting the technology.

The security industry needs to focus on defending against the harmful applications of AI while businesses develop appropriate policies and controls.

The emergence of agents adds another layer of complexity because these systems may be authorised to perform tasks on behalf of individuals or organisations, Schomburgk said.

"Who is the agent? Who are they acting on behalf of, and do they have the authority to do that?" he said.

Securing AI agents requires organisations to verify their identities and determine whether they have appropriate permissions before allowing them to carry out actions.

Quantum computing on the horizon

While AI is the immediate focus for many security leaders, quantum computing is also beginning to appear more prominently in discussions about future cybersecurity risks, Schomburgk explained.

The Australian Signals Directorate and government agencies have ramped up awareness efforts, encouraging organisations to consider the implications of advances in quantum technology.

Unlike AI-related threats, which are already influencing phishing and other cyberattacks, the timeline of quantum computing's potential impact on existing security systems remains uncertain.

Schomburgk contrasted the challenge with preparations for the Y2K bug, where organisations could work towards a clear deadline.

Businesses know the issue of quantum computing is approaching, but cannot identify a precise time when it will become an immediate concern.

That lack of clarity is making it difficult to secure investment and attention when organisations are already dealing with more immediate issues, like AI security, governance, and policy development.