In partnership with
👋 Welcome to Unlocked
Most organizations invest heavily in login security.
Stronger passwords.
Multi-factor authentication.
Device verification.
Risk-based access.
On paper, the front door is locked tighter than ever.
But attackers rarely use the front door anymore.
They walk straight to the side entrance labeled: “Forgot password?”
Welcome to the recovery gap — one of the least discussed yet most consistently exploited weaknesses in modern security.
🧠 The Security Paradox No One Talks About
Authentication has become more sophisticated over the past decade — guided in part by standards like the NIST Digital Identity Guidelines, which emphasize layered identity assurance and phishing-resistant authentication.
Yet despite stronger login controls, account takeovers continue to surge.
Why? Because recovery flows are designed with a very different priority:
speed over scrutiny.
After all, locked-out users are frustrated users.
Frustrated users open tickets.
Tickets create downtime.
Organizations optimize recovery for convenience. Attackers optimize for that convenience too.
🚪 Attackers Don’t Break Authentication — They Wait for You to Bypass It
Consider how many recovery paths exist inside a typical enterprise:
help desk resets
SMS verification
backup email links
knowledge-based questions
device re-enrollment
delegated admin resets
Each pathway exists for a legitimate reason.
But each is also a potential shortcut around your strongest controls.
CISA has repeatedly warned that identity processes — including password resets — are prime targets for social engineering attacks.
The logic is simple: Why defeat MFA…when you can convince someone to reset it?
🎭 The Human Override Problem
Most recovery isn’t technical.
It’s conversational.
An attacker calls the help desk:
“I’m traveling.”
“My phone was stolen.”
“I can’t access my authenticator.”
“The board meeting starts in 10 minutes.”
Now the security decision shifts from systems…
to a person under pressure.
Microsoft has documented how social engineering campaigns increasingly target support workflows because they rely on human judgment rather than cryptographic proof.
Recovery becomes a moment where policy meets empathy — and empathy often wins.
⚠️ Recovery Is Expanding the Identity Attack Surface
Modern identity environments are no longer simple.
They include:
workforce identities
contractors
vendors
developers
machine identities
service accounts
Every identity eventually needs recovery.
Which means your recovery design is effectively part of your perimeter.
The Zero Trust Maturity Model from CISA reinforces this idea — trust must be continuously evaluated, not granted through one-time verification.
If recovery bypasses verification, Zero Trust quietly collapses.
🔓 The Most Common Recovery Weak Points
Security teams often discover these only after an incident.
Support teams frequently have the power to reset the very controls security deploys.
Without strong verification standards, the help desk becomes a high-value target.
2. Fallback Factors
Backup methods tend to be weaker than primary ones.
Think:
SMS instead of phishing-resistant MFA
personal email instead of corporate identity
security questions with publicly discoverable answers
NIST has explicitly discouraged knowledge-based authentication because answers are often easily obtained.
3. Silent Enrollment
If an attacker can register a new device during recovery, they don’t just access the account — they persist inside it.
4. Over-Privileged Reset Paths
Some workflows allow password resets without evaluating the sensitivity of the account being recovered.
Resetting a marketing user is not the same as resetting a domain admin.
But many processes treat them equally.
Attackers notice that.
🧩 Why This Problem Is Getting Bigger — Not Smaller
Three macro trends are quietly widening the recovery gap:
1. Identity Sprawl
Organizations now manage thousands — sometimes millions — of identities.
More identities = more recovery events = more opportunities.
2. Always-On Business Expectations
Downtime is unacceptable.
Recovery is pressured to be immediate.
Security rarely thrives under urgency.
Attackers arrive prepared:
scraped employee data
org charts
vendor relationships
executive names
travel patterns
They don’t sound suspicious anymore.
They sound informed.
MITRE ATT&CK tracks social engineering under techniques designed specifically to manipulate trusted workflows — not bypass technology.
🛡️ How Security Leaders Should Respond
Closing the recovery gap doesn’t mean making recovery painful.
It means making it intentional.
✅ Treat Recovery Like Authentication
Apply the same rigor:
phishing-resistant verification where possible
step-up authentication
identity proofing
behavioral signals
Recovery should never be weaker than login.
✅ Tier Your Recovery Controls
Not every account carries equal risk.
Executives, finance, admins, and developers should require stronger recovery verification.
✅ Slow Down High-Risk Changes
Speed is the attacker’s ally.
Introduce friction when it matters:
delay MFA changes
alert users to recovery attempts
require secondary approval
A few extra minutes can stop a breach.
✅ Test Your Recovery Process
Many organizations test phishing resilience…
but never test the help desk.
Run a controlled recovery simulation.
See what actually happens.
You may learn more than any audit could reveal.
💡 Unlocked Tip of the Week
Ask One Question at Your Next Security Meeting:
“Is it easier to reset an account than to break into one?”
If the answer is yes — even slightly — that’s where your next investment belongs.
Because attackers don’t hunt for the hardest control.
They hunt for the easiest bypass.
📊 Poll of the Week
Which recovery pathway worries you most?
🔥 Final Takeaway
For years, cybersecurity focused on building stronger locks.
But the future of identity risk isn’t about the lock.
It’s about who is allowed to issue a new key.
The organizations that rethink recovery now will quietly prevent the breaches everyone else is still trying to detect.
Because in modern security…
the fastest way in isn’t breaking authentication.
It’s being invited around it.
Stay ready. Stay resilient.
Until next time,
Meet Ethan Cole - Senior Security Engineer
Ethan Cole is a Senior Security Engineer with more than a decade of experience building secure SaaS products and protecting cloud-native infrastructure. He specializes in identity and access management, anomaly detection, and secure deployment pipelines — helping product teams bake threat modeling and privacy-first design into everyday engineering work. When he’s not reviewing alert triage playbooks, he’s mentoring junior engineers, contributing to open-source tooling for secure CI/CD, and experimenting with home lab automation.
About Our Sponsors
NEO
Trust-First AI, Built Into Your Browser
Agentic workflows are everywhere. Real trust is still rare.
Norton Neo is the world’s first AI-native browser designed from the ground up for safety, speed, and clarity. It brings AI directly into how you browse, search, and work without forcing you to prompt, manage, or babysit it.
Key Features:
Privacy and security are built into its DNA.
Tabs organize themselves intelligently.
A personal memory adapts to how you work over time.
This is zero-prompt productivity. AI that anticipates what you need next, so you can stay focused on doing real work instead of managing tools.
If agentic AI is the trend, Neo is the browser that makes it trustworthy.
Try Norton Neo and experience the future of browsing.
IT Brew
Become the “know-IT-all”
Modern IT doesn’t live in one lane.
IT Brew is a free, four-times-a-week newsletter covering the full range of stories shaping business tech—from cybersecurity and cloud to enterprise software, infrastructure, and data privacy.
It delivers clear, reliable context in one email, so you’re not piecing together headlines from everywhere else.
Join 125K+ IT leaders who rely on IT Brew for comprehensive industry insight.