AI-cloned voices and compromised smartphones weaken software MFA. At it-sa 2026, Yubico’s Alexander Koch explains why companies are turning back to dedicated security keys.
Artificial intelligence is undermining classic security barriers and software-based MFA on smartphones, even though European rules call for reliable phishing protection. In an interview at it-sa 2026, Alexander Koch, SVP Sales EMEA at Yubico, explains how physical security keys make identity verification dependable again, and why pure software solutions no longer hold up against current threats.
Security leaders face a changed threat landscape. AI tools let attackers imitate human voices convincingly, so voice-based checks lose their protective value. SMS confirmations fall short as well, because mobile connections can be intercepted. A survey by Yubico and Okta among 1,890 security and IT professionals in nine countries shows how far practice lags behind: 44 percent reported an AI-driven attack within twelve months (Germany: 38 percent), and 43 percent still rely on passwords at work, although many rate passkeys as more secure, and 52 percent inherited their passwords on day one.
Why the smartphone falls short
Many companies long relied on authenticator apps on company phones. Yet smartphones are complex software devices exposed to malware, and malicious apps can capture credentials before a security prompt is processed. Effective protection requires systems that operate separately from the device’s operating system.
Koch describes the urgency: “Companies are returning to the classic hardware token, after saying for a while that an authenticator on the smartphone was secure enough. A smartphone is software, and a device where you don’t really know what is happening on it. The YubiKey is a dedicated hardware security device that largely rules out phishing attacks, because the digital identity stays on the element and never leaves it.” It is a passwordless approach, he adds, in which no password travels over the network.
European production as a supply-chain argument
Regulations such as NIS2 and DORA require operators of critical infrastructure to demonstrate robust supply chains and auditable security standards. According to Yubico, its keys are made exclusively in two plants in Sweden, with a secure element from Infineon.
Koch: “Especially in the European context, companies say: this is European technology, we support that, and it gives a sense of security. […] Because our headquarters is in Stockholm, all parts of the organization, from finance to legal, are present in Sweden, and we are fully subject to EU law.” Customers can buy keys outright or use a service model; under the latter, Yubico partly has access to data, which remains in the EU. Many mid-sized customers buy on-premises, and serial numbers are deleted once keys have shipped.
Securing the first delivery
The initial hand-over to employees is a critical moment: a token intercepted or swapped in the mail could let an attacker take over an identity. Modern distribution models therefore use separate channels for hardware and unlock codes, or let established colleagues vouch for new staff.
Koch outlines the process: “It is very close to a credit card experience: the employee is sent the token and receives a separate envelope with the PIN, with which they open the key once and set their own PIN. Among colleagues, an existing employee can scan a QR code and ensure secure onboarding.” He says Yubico is the only vendor offering this seamless process from production to employee, which lets security officers tick several compliance boxes at once.
Hardware keys versus software passkeys
Passkeys built into operating systems offer convenience but are tied to the individual device, and reach their limits when employees switch between systems or mobile devices. A physical key works across platforms via USB or near-field communication, without credentials remaining on the device.
Koch: “The hardware key can be used universally via USB and NFC; I only have to hold it to the device. In addition, we cut the onboarding time for new employees from half an hour to one minute, which drastically reduces support costs.” He puts the price in perspective: a headset costs about 120 euros, a YubiKey 50 to 60 euros.
Yubico is also extending the concept beyond login. YubiKey 5.8, released in July 2026, adds CTAP 2.3 support and a preview of a WebAuthn signing extension, so keys can back actions such as document signing or approvals. That matters as AI agents arrive: 91 percent of survey respondents want a human approval step before agents execute critical actions.
Protection for the whole organization
Concepts fall short if they cover only executives or administrators, since attackers prefer less protected accounts as a bridgehead. According to Koch, BMW has more than half a million YubiKeys in use, and banks such as Santander, ING and Commerzbank are customers. In Europe, sales run exclusively through partners serving the mid-market. At it-sa, 16 colleagues from the German team were on site; when Koch started eight years ago, there were two.
His conclusion: “It is about moving away from protecting individual exposed users toward securing the entire organization. The goal is to give the entire company simple and reliable protection.”
Dr. Dietmar Müller is an experienced IT journalist and editor-in-chief of Beyond Buzzwords. He has decades of expertise in the German and international IT markets, as well as extensive editorial experience at renowned publishing and media companies such as Springer, IDG, and CBS Interactive. Whether writing cross-media technical articles, conducting in-depth analyses, or conducting insightful interviews—whether at his desk or in direct dialogue with industry leaders—Dr. Dietmar Müller is right at home in the world of enterprise IT. His key areas of focus include enterprise IT and OT architectures, the cloud, ERP, MES, data centers, cybersecurity and compliance, industrial automation, and AI governance, among others.