Fact or Fiction: Passkeys can't be phished.
Mostly fact. A passkey is bound to the real site, so a fake login page has nothing to steal. Passwordless works best when the whole access journey is protected, not just the login screen.
2
226
API keys and access tokens are the new passwords. 🔑
Non-human identities often outnumber your people, and a stolen key can look like normal traffic. CISOs share how to get NHIs under control: cs.co/6010BHLk4K
1
232
Live tomorrow at 11 AM PT 🗓️
Small team, big security to-dos? Join Duo, Cisco Talos and Credible Security for practical ways to protect access without adding complexity.
Can’t make it? We’re back December 2 and January 13.
Save your spot: cs.co/6014BHx690
153
What a great time at #Authenticate2026! 💚
Thanks to everyone who visited Booth 207 and joined our sessions. From passkeys to AI agents to Active Directory risk, it was great talking about what’s next for identity with the FIDO community.
See you next year!
181
A stolen login is the best costume an attacker can wear. Duo Agentic IAM sees through it.
Human or AI agent, every identity gets checked.
1
206
That's a wrap on Cybersecurity Awareness Month! We covered 4 identity attacks: fake MFA emails, code texts, QR codes & phishing invites.
Same goal: get into your accounts to steal data, move money, or launch their next attack.
Slow down, go direct & never share MFA codes.
Phishing works because it looks real, not because people are reckless.
Phishing-resistant authentication skips the code or tap. It checks something attackers can't fake: proximity between the device logging in and the one that's already trusted. cs.co/6013BHlp9b
One week out: Is MFA alone still enough?
AI-powered attackers move fast. Lean teams need stronger identity protection without the complexity.
Join experts from Credible Security, Cisco Talos & Duo live on Nov 4.
Reserve your spot 👉 cs.co/6015BHcYEx
Would you click it?
Calendar invite phishing is easy to fall for because invites can land on your calendar automatically, right next to your real meetings.
Always check the organizer’s full email address, and don't log in through links in a meeting invite.
1
201
Fact or Fiction: Compromised credentials are yesterday’s problem.
Fiction. Attackers still rely on valid identities because logging in is often easier than breaking in. Weak MFA, unmanaged devices, stolen sessions, and blind spots can turn a compromised account into a breach.
319
Enterprises are adding AI agents faster than employees, but most IAM platforms weren't built to give software an identity.
Cisco's Matt Caulfield explains in VentureBeat how to move from access control to action control: cs.co/6016BHb1ye
1
194
Ransomware attacks on education are up 23% year over year. Every fall brings new students, new devices, and more sensitive data, from SSNs to medical records.
See how institutions protect it all at scale, without a bigger budget: cs.co/6010BHk7A0
The Duo Download Newsletter is live!
It’s your quarterly recap of the biggest news, innovations, and developments in identity security and access management.
Read it below 👇 and hit subscribe for future updates
cs.co/6013BHpk9H
2
280
🛑 STOP before you scan that email QR code.
"Quishing" is hitting inboxes at a rate of 240K+ per month. Scammers are ditching links for codes to bypass your security.
🛡️ See the 2-card guide below to spot a digital trap in seconds.
Stay secure. Scan smart.
185
Entra ID and Active Directory are foundational. Identity security extends beyond them.
Episode 5 of Duo’s video podcast series shows how Duo expands visibility, prioritizes risk, and extends protection while building on those investments.
Watch now: cs.co/6018BHKXQo
1
3
329
AI-powered identity threats demand more than MFA. Learn how lean security teams are protecting more users, devices, and apps with a security-first approach.
Pick from three session times and register now: cs.co/6015BHGjWF
206
In the 2026 CISO Perspectives report, 28 global security leaders share how they're tackling:
✅ The Identity Gap
✅ Passwordless Transitions
✅ Legacy infrastructure
…all while using Zero Trust to turn security into a competitive advantage.
🔗 cs.co/6016BH127y
Two texts. One is real. One is phishing your account.
Your MFA code helps keep attackers out of your account. No legitimate person, including IT, will ever ask you to share it.
⚠️ Got a code you didn’t request? Someone may know your password. Report it to IT right away.
People who change roles accumulate access like frequent flyer miles. When you leave a company, your access gets shut off. When you switch teams or roles, old access often just… stays.
This Cybersecurity Awareness Month, help IT keep your access current: cs.co/6011BG7rXS
Striking the right balance between UX & security is a challenge for many companies. Lean too far either way and you frustrate users or create risk. Room & Board found that balance, giving design associates secure, flexible access without slowing down: cs.co/6010BGfl6m














