A password can be stolen. A FIDO key cannot.
Phishing-resistant multi-factor authentication exists: a USB security key, or the same badge as the one for your door. Test it against a fake site.
Why the password is no longer enough
The weak point is not the complexity of the password: it is that its owner can give it away without knowing.
It can be guessed, it gets reused
A password reused on another service is exposed as soon as that service is breached. A weak password falls at the first automated attempt.
It gets handed over on a fake site
A convincing message, a page that imitates yours: the user types the password, and the attacker receives it.
The SMS code follows the same path
A one-time code typed on a fake site is immediately replayed by the attacker on the real one. It slows the attack down; it does not prevent it.
MFA in four steps
Multi-factor authentication combines several proofs: what you know, what you have, what you are. Not all forms are equal when facing phishing.
A secret that can be guessed, reused or given away.
To be replacedA second factor, but one that can be hijacked: the code is typed on the fake site just like the password.
Needs improvementStronger than SMS, but the code is still typed by the user: it can be given to a fake site.
AdequateThe key only answers the site it was registered for. There is nothing to type, so nothing to give away.
Recommended
How a FIDO2 key defeats the fake site
FIDO2 is based on two standards: WebAuthn, on the browser side, and CTAP, between the key and the computer.
Registration
The key creates a key pair specific to the site. The site keeps only the public key. The private key never leaves the key.
Challenge
At each sign-in, the site sends a one-time challenge: a number the key must sign.
Address check
The key checks the site address before signing. On a fake site, the address does not match: it does not answer.
Signature
On the real site, one gesture is enough (touch the key, enter a PIN) and the site validates the signature.
The USB security key
A small device that plugs into USB-A or USB-C, sometimes also with NFC. Touching it is enough to confirm a sign-in.
- One key per user, registered on every account to be protected
- Ideal for administrator accounts, e-mail and remote access
- A PIN can be added to the confirmation gesture
- One backup key per user, registered from the start
Keys are chosen according to your workstations and services. SCAP helps you choose the ones that suit your environment.
A FIDO option in the access badge
The badge that opens the door can also open its holder's session: one card combines the access control DESFire® chip and a FIDO2 function.
A single object
The employee already carries a badge. There is no extra key to carry, forget or lose.
A single revocation
The day the badge is lost or handed back, a single block cuts off both physical access and workstation access.
A single policy
Physical security and IT security rely on the same credential, managed by the same rules.
The workstation must be able to read the card (desktop reader, or NFC). We check the compatibility of your workstations and services with you before any roll-out. See our desktop readers.
NIS 2: what it changes for you
The European NIS 2 directive raises the cybersecurity level of organisations classed as "essential" or "important". It covers both logical and physical access.
What it requires
Risk-management measures (article 21): access control policies, asset management, multi-factor or continuous authentication, and protection of the physical environment of information systems.
Who is responsible
Management approves these measures and is accountable for them (article 20). It is not just an IT matter.
What is at stake
Fines of up to 10 million euros or 2% of worldwide turnover for essential entities, 7 million or 1.4% for important entities (article 34).
What SCAP helps you put in place
- Logical and physical access control: secret-key badges, encrypted reader-to-controller link, SAM card and key ceremony. See the guide
- Multi-factor authentication: FIDO2 security keys and badges with a FIDO option.
- Protection of the physical environment: readers, controllers, access traceability and monitoring.
- Asset and credential management: issuing, validity and revocation of badges, key log.
Where does France stand?
The directive applies through each Member State's law. At the time of writing (November 2026), the French transposition law, known as the "resilience law", had not yet been adopted, according to the sources consulted. The obligations of article 21 already describe the expected good practice. Check the current situation with ANSSI. This page is general information, not legal advice.
Find out more
- New standards: DUOX, PKOC, Aliro: the same key-pair idea, in the badge and in the phone.
- ANSSI, the NIS 2 directive: overview, entities concerned, timetable (in French).
- Directive (EU) 2022/2555 (NIS 2): official text, articles 20, 21 and 34.
- W3C, Web Authentication (WebAuthn): the browser-side standard.
- FIDO Alliance: FIDO2 standards and passkeys.
FIDO and FIDO2 are designations of the FIDO Alliance. The other trademarks mentioned belong to their respective owners.