Loading story…
CISA launched its Secure by Design Pledge, asking software manufacturers to make measurable security improvements that reduce customer risk by default. The pledge emphasizes practices such as shipping products with secure default configurations, increasing transparency, reducing entire classes of vulnerabilities, and strengthening identity protections so customers are not left to bolt on basic safeguards after deployment.
Snowflake said it will make multi-factor authentication (MFA) the default for its platform, aligning with the broader industry push toward secure-by-default identity controls. The move reflects one of the core themes promoted by CISA: vendors should build stronger protections directly into products, particularly around authentication and account security, rather than relying on customers to enable critical defenses themselves.
See the reporting duties and controls this puts on the clock.
2 events from the most recent confirmed update back to the earliest known activity.
CISA published its Secure by Design Pledge page, outlining a voluntary pledge for technology manufacturers to commit to secure-by-design principles. The publication marks a formal public rollout of the pledge initiative.
Snowflake announced that multi-factor authentication would be enabled by default for all newly created accounts. The announcement was made in a company blog post titled "Snowflake Will Default to Multi-Factor Authentication."
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent high-profile breaches at major UK retailers, including M&S and Co-op Group, have highlighted the growing threat of identity-based attacks. Attackers used vishing techniques to obtain corporate passwords, which enabled ransomware deployment and resulted in significant financial and reputational damage. The distributed nature of modern IT environments, with resources spread across cloud and on-premises systems, has made identity the new security perimeter, increasing the value of credentials for cybercriminals. Infostealer malware and various forms of phishing, including smishing and vishing, are now primary methods for harvesting credentials, contributing to a surge in identity-related breaches across industries. To counter these threats, security experts emphasize the importance of robust multifactor authentication (MFA), particularly methods that are resistant to phishing. While traditional MFA methods such as one-time passwords (OTPs) sent via SMS or email are still widely used, they are increasingly vulnerable to social engineering and interception. The adoption of passkeys and other phishing-resistant MFA solutions is being promoted as the gold standard, with Microsoft reporting that MFA blocks over 99% of unauthorized access attempts. Organizations are urged to move beyond basic MFA and implement stronger, phishing-resistant authentication to protect against evolving identity-based attacks.
Jun 29, 2026
A new report from password manager 1Password highlights that weak or compromised passwords remain a significant security risk for organizations, with employee password practices worsening despite increased awareness. Survey data from over 5,000 workers across multiple countries reveals that a majority of employees, including IT professionals, continue to reuse passwords, rely on default credentials, or share passwords via insecure channels, exacerbating the threat landscape for businesses. The report underscores that even as companies move toward passwordless authentication, the transition is gradual and current credential management practices are not keeping pace with evolving threats. In response to these challenges, technology vendors are accelerating the adoption of passwordless solutions. Microsoft has released Edge version 142.0, introducing cross-platform passkey synchronization, allowing users to securely reuse passkeys across devices and browsers. This feature, which requires a dedicated PIN for access, aims to enhance both security and usability, reducing reliance on traditional passwords. The move reflects a broader industry trend toward passkeys and multi-factor authentication as default options, with major platforms like Google and Meta also embracing passwordless technologies to mitigate the risks associated with password-based authentication.
Jun 29, 2026
Organizations are increasingly moving towards passwordless authentication methods, with technologies such as passkeys and device identity gaining traction as more secure alternatives to traditional passwords and multi-factor authentication (MFA). Passkey authenticators, often integrated into password managers or as standalone components, play a critical role in enabling seamless and secure login experiences by leveraging new standards and cryptographic techniques. Device identity further enhances security by binding credentials to hardware, making authentication resistant to phishing and social engineering attacks, while also improving user experience by reducing prompt fatigue and streamlining access to applications and networks. The identity security market is also witnessing strategic acquisitions, such as Ping Identity's purchase of Keyless, which aims to integrate privacy-preserving biometric authentication for frontline workers and address emerging threats like deepfakes. These moves reflect a broader industry trend towards comprehensive identity lifecycle management, resilience against AI-driven threats, and scalable support for both human and machine identities. As economic constraints limit large-scale mergers, the focus is shifting to targeted acquisitions that expand platform capabilities and reinforce the shift to passwordless, device-centric authentication models.
Jun 29, 2026