To date, NIST has endorsed only two phishing-resistant solutions: FIDO and Smart Card/PIV (PKI), Gartner has endorsed the FIDO Security Key and X.509 Hardware Token as the highest trust level for authentication. While mobile-based passkeys (synced via iCloud/Google/Microsoft) are considered high-security (AAL2), they remain vulnerable to OS alteration by virus, malware, backdoor. Hardware keys are the only way to achieve Authenticator Assurance Level 3 (AAL3), the gold standard for high-value corporate accounts
